微信公众号写作发布助手

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:05 AM UTC
• Version: 1.0.6

Overview

This is a coherent WeChat draft-writing skill, but it needs review because it can fetch arbitrary URLs, upload user-controlled local file paths to WeChat, and enables account-side draft actions too broadly.

Install only if you are comfortable with a local tool that can use WeChat credentials, fetch web pages, create draft-box entries, and upload local images. Keep DRY_RUN=1 until you have reviewed the generated JSON, image paths, source attribution choices, and exact draft content; do not feed it untrusted URLs or generated JSON without checking paths first.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:21

Finding

Default Follow Call-to-Action Injects Promotional Content into Published Articles

Content

View full analysis

如果你关注 AI 产品、技术趋势和真实落地，欢迎点个关注。

我会继续用更少废话，把值得看的变化讲清楚。

``` ### Technical Analysis The Skill instructs the agent to add an account-growth call to action by default to publication-ready articles. This behavior is reinforced in the primary Skill instructions, the agent's default prompt, the generated JSON example, and the upload workflow. Adding a follow prompt can be a legitimate publishing feature when explicitly requested. However, making it the default changes the user's deliverable for the benefit of the destination account. The fixed reusable wording also creates a persistent output-injection pattern rather than a contextual editorial choice. This behavior exceeds the minimum privileges required for article writing and draft creation. Neither generating an article nor uploading it to the WeChat draft box inherently requires adding promotional language. ### Attack Path 1. A user invokes the Skill to write or prepare an article. 2. The Skill's default instructions activate the follow-CTA requirement. 3. The agent generates publication-ready HTML containing promotional follow language. 4. The generated JSON passes validation because the CTA is an expected part of the workflow. 5. If draft creation is enabled, the modified article is uploaded to the user's WeChat draft box. 6. The user may publish the injected promotional content without noticing that it was added by default. ### Impact Assessm ...[truncated 482 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Warning

• Location: scripts/wechat-article-workbench/src/generated-schema.mjs:30

Finding

Source Attribution Is Deliberately Suppressed and Rejected by Validation

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/wechat-article-workbench/src/config.mjs:38

Finding

Unrestricted Image Paths Allow Arbitrary Local Files to Be Uploaded to WeChat

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/wechat-article-workbench/src/http.mjs:7

Finding

Arbitrary Source URL Fetching Enables Server-Side Request Forgery

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/wechat-article-workbench/package-lock.json:18

Finding

Mandatory Dependency Installation Uses a Third-Party Registry Mirror

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (29)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 50)May include surrounding context.

bash

npm install
cp config.example.env .env

Then edit .env:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/image-and-draft-upload.md (reported line 19)May include surrounding context.

bash

npm install
cp config.example.env .env

Then edit .env:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/wechat-article-workbench/README.md (reported line 53)May include surrounding context.

bash

npm install
cp config.example.env .env

Then edit .env:

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

• Category: Supply Chain
• Confidence: 85% confidence

Finding

The lockfile pins form-data 4.0.5, which is reported vulnerable to CRLF injection in multipart field names/filenames. In a tool that uploads generated article assets/content to external platforms, any code path that builds multipart requests from partially user-controlled names could allow header/body injection or malformed outbound requests, though exploitability depends on actual use of form-data rather than mere presence in the dependency tree.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: sharp==0.33.5 — 2 advisory(ies): GHSA-f88m-g3jw-g9cj (sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-); GHSA-rgj7-g3m4-5g8c (sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545)

High

• Category: Supply Chain
• Confidence: 92% confidence

Finding

sharp 0.33.5 bundles or depends on native image-processing components with published vulnerabilities in libvips/libheif. This skill explicitly supports cover generation, inline images, and architecture/flowchart graphics, so it is likely to process attacker-influenced images or formats; malformed files could trigger denial of service or potentially memory-safety issues in native code.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: undici==6.25.0 — 7 advisory(ies): CVE-2026-6733 (undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse); CVE-2026-16728 (undici vulnerable to downstream response desynchronization via retry interceptor); CVE-2026-11525 (undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive subs) +4 more

High

• Category: Supply Chain
• Confidence: 88% confidence

Finding

undici 6.25.0 is flagged for multiple HTTP parsing/session-handling issues, including response queue poisoning and response desynchronization. This skill appears to fetch external links for translation/rewrite/news aggregation and may upload content remotely, making an HTTP client dependency security-relevant: interacting with malicious or intermediary-controlled servers could lead to request/response confusion, cookie handling issues, or data integrity problems.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.20.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

ws 8.20.0 has advisories for memory disclosure and memory-exhaustion DoS, but here it is only present as a transitive dependency of jsdom and may not be actively used by the skill. If any feature enables WebSocket handling against untrusted endpoints, malformed frames could destabilize the process; otherwise the practical risk is limited by likely non-use.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: sharp==0.33.5 — 2 advisory(ies): GHSA-f88m-g3jw-g9cj (sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-); GHSA-rgj7-g3m4-5g8c (sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545)

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

This package depends on sharp 0.33.5, which is flagged as containing inherited vulnerabilities in native image-processing libraries such as libvips and libheif. In the context of a WeChat article writer that generates cover images and inline illustrations, the skill is likely to process untrusted or externally sourced image content, making parser bugs in image codecs meaningfully exposed and increasing the risk of crashes, memory corruption, or potentially code execution depending on the underlying flaw.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/wechat-article-workbench/src/config.mjs (reported line 9)May include surrounding context.

js

const __filename = fileURLToPath(import.meta.url);
export const projectRoot = path.resolve(path.dirname(__filename), "..");

dotenv.config({ path: path.join(projectRoot, ".env"), quiet: true });

export const config = {
  curatedAihotUrl: process.env.CURATED_AIHOT_URL || process.env.AIHOT_URL || "https://aihot.virxact.com/",

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill explicitly supports generating local files and creating real WeChat draft-box entries, but the markdown does not clearly require a fresh, explicit user confirmation immediately before performing those side effects. In an agent setting, this increases the risk of unintended publication actions or local writes being triggered from an ambiguous prompt, especially because the workflow defaults toward draft preparation and upload behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest advertises uploading drafts to a WeChat account but does not warn users about external side effects, account usage, or content being transmitted to a third-party platform. In this skill context, that omission is more dangerous because the tool is specifically designed for generating and then pushing content outward, which can surprise users and cause accidental publication workflow changes.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The default prompt is a very broad natural-language invocation that bundles content generation, image generation, formatting, and draft upload into one generic trigger. This increases the chance the skill is invoked in situations where the user did not clearly intend external-account actions, especially because the prompt does not require explicit confirmation before publication-related steps.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Implicit invocation is enabled even though the skill can perform side-effecting operations involving a WeChat account draft box. Without strict activation boundaries, normal conversation about article writing or WeChat content could automatically activate a skill capable of uploading drafts, creating a risk of unintended external actions and data transfer.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file includes prescriptive Chinese-only title, opening, and readability patterns such as Chinese example phrases and a requirement to use short paragraphs of Chinese sentences. Because it presents these as default writing instructions without opt-in or a documented region-specific justification, it creates a language/locale policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The document repeatedly specifies Chinese-only output expectations such as 微信公众号标题 and later explicitly says to reorganize content into a Chinese public-account article. This imposes a specific language/locale behavior without indicating user opt-in or documenting a justified region-specific restriction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The checklist requires output headings in Chinese and includes a quality rule tied specifically to 'the first 200 Chinese characters,' which effectively forces a specific language/locale. Under the policy, language constraints should either be optional for the user or clearly justified as region-specific; neither is stated here.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

When args.url is provided, the script calls extractArticle(base), which by the function name and surrounding logic is intended to retrieve and process remote article content. This file provides no inline warning, confirmation, or user-facing disclosure that supplying a URL will trigger network access and transmit the URL/input to another component.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

These validation rules reject content based on specific Chinese phrases and labels, effectively imposing a locale/language-specific policy in code. The file does not provide any user choice or documented justification that this validator is intentionally limited to a Chinese/WeChat-only workflow.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/wechat-article-workbench/src/wechat.mjs (reported line 32)May include surrounding context.

js

throw new Error("WECHAT_APPID and WECHAT_APPSECRET are required");
  }

  const data = await postJson("https://api.weixin.qq.com/cgi-bin/stable_token", {
    grant_type: "client_credential",
    appid: config.wechatAppId,
    secret: config.wechatAppSecret,

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/wechat-article-workbench/src/wechat.mjs (reported line 63)May include surrounding context.

js

throw new Error("WECHAT_APPID and WECHAT_APPSECRET are required");
  }

  const data = await postJson("https://api.weixin.qq.com/cgi-bin/stable_token", {
    grant_type: "client_credential",
    appid: config.wechatAppId,
    secret: config.wechatAppSecret,

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/wechat-article-workbench/src/wechat.mjs (reported line 117)May include surrounding context.

js

throw new Error("WECHAT_APPID and WECHAT_APPSECRET are required");
  }

  const data = await postJson("https://api.weixin.qq.com/cgi-bin/stable_token", {
    grant_type: "client_credential",
    appid: config.wechatAppId,
    secret: config.wechatAppSecret,

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/wechat-article-workbench/src/wechat.mjs (reported line 150)May include surrounding context.

js

throw new Error("WECHAT_APPID and WECHAT_APPSECRET are required");
  }

  const data = await postJson("https://api.weixin.qq.com/cgi-bin/stable_token", {
    grant_type: "client_credential",
    appid: config.wechatAppId,
    secret: config.wechatAppSecret,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The uploadPermanentImage function posts image data to api.weixin.qq.com, and uploadArticleImage does the same later in the file. This file contains no user-facing warning, prompt, or explanatory comment that local files are transmitted to an external service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

createDraft sends article title, digest, HTML content, thumbnail media ID, and optional author metadata to the WeChat API. There is no confirmation, visible notice, or inline documentation here warning that authored content will be sent to a third-party platform.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This markdown file instructs the user to create a .env file and populate WECHAT_APPID and WECHAT_APPSECRET, which are sensitive credentials. While the file explains how to configure them, it does not include an explicit warning to keep the .env file private, avoid committing it, or otherwise protect the secrets.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.