Security audit

Mukun Md Push Wechat

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Markdown-to-WeChat/Juejin draft publishing skill, but it requires account credentials and can send article content and referenced images to those services.

Install only if you intend to let an agent create or update WeChat/Juejin drafts for you. Treat the WeChat AppSecret and Juejin cookie as account credentials: keep config.yaml private, do not commit or share it, restrict file permissions, and review Markdown plus referenced local images before using any push command.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (14)

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The README instructs users to store WeChat AppID and AppSecret in a plaintext local config file without any warning about credential sensitivity, file permissions, or avoiding commits and logs. Secrets in home-directory config files are commonly exposed via backups, screenshots, shell history, repo commits, or overly broad agent/tool access.

Missing User Warnings

High

Confidence: 97% confidence
Finding: A Juejin session cookie is effectively a bearer credential for the user's account, and the README tells users to paste it into config.yaml without warning that compromise of the cookie can permit account access and drafting actions. In an agent-skill context, storing session cookies in plaintext is especially risky because tools and models may read local config files during unrelated tasks.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill guides the agent to push Markdown content, generated HTML, titles, digests, cover metadata, and possibly embedded image references to external WeChat and Juejin services, but it does not prominently warn the user that this causes data transmission outside the local environment. In an agent setting, lack of explicit disclosure can lead to accidental publication or exfiltration of sensitive draft content, especially when users may think they are performing a local format conversion only.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill instructs access to `~/.md_push_wechat/config.yaml` containing app credentials and a browser-derived Juejin cookie, but it does not provide a strong user-facing warning that sensitive local secrets will be read and used for authenticated remote actions. In an agent workflow, this creates real risk of unintended credential use, disclosure in logs/output, or acting on behalf of the user without sufficiently informed consent.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The example promotes automatic collection of Git, task, and chat data for LLM processing and outbound delivery without warning about privacy, confidentiality, or consent requirements. In a workplace context, this can lead users to aggregate and disclose sensitive internal data to third-party systems without review.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The Feishu webhook example sends generated report content to an external endpoint with no warning that the content leaves the local environment. Because the report may contain commit messages, project status, and risk notes, users could unintentionally transmit sensitive business information to a broadly accessible chat destination.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The article explicitly demonstrates sending generated weekly report content to Feishu via webhook, which can expose potentially sensitive internal work data to an external messaging platform without any warning, validation, or data-classification guidance. In an agent/automation context, examples often get copied directly into production, so omission of privacy/security caveats increases the chance of unintended data leakage.

Missing User Warnings

Medium

Confidence: 77% confidence
Finding: The article describes automated collection of work data from repositories and chat/task systems and outbound posting to collaboration platforms without any privacy, consent, or disclosure warning. In the skill context, this can normalize unsafe handling of potentially sensitive internal work data and lead users to export proprietary information to third-party destinations without adequate review.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The example states that raw Git commits and task-card data are sent to an LLM for summarization but omits any warning that this may transmit sensitive development metadata to an external model provider. In this skill ecosystem, that omission is dangerous because users may assume local-only formatting behavior while actually exposing proprietary work content to a third party.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The example code shows sending arbitrary report content to an external Feishu webhook without any warning, sanitization, content review, or mention of access control. In practice, users may copy this pattern and transmit sensitive internal data such as commit messages, task details, or chat-derived content to third-party endpoints, causing unintended data exposure.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The documentation instructs users to place a long-lived WeChat AppSecret in a plaintext local config file without any guidance on file permissions, secret storage, or leakage risks. This can expose credentials through backups, source control, shared machines, logs, or malware, enabling unauthorized access to the公众号 API and misuse of the associated account.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The trigger list includes many generic descriptive terms such as '蓝色', '正式', '规范', '产品文档', and '技术手册', which can match ordinary user requests unrelated to this specific skill. In an agent environment, overly broad triggers can cause unintended activation, routing user content into conversion/publishing workflows the user did not explicitly request, increasing the chance of misfires or unauthorized downstream actions.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The script requires a live Juejin browser session cookie from a local config file and automatically sends it in authenticated requests to remote APIs. While this is expected for the feature, there is no explicit consent prompt, redaction guidance, or warning that the cookie is a sensitive bearer credential, so accidental credential misuse or leakage is possible.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The script scans the Markdown body for local images, reads matching files from disk, and uploads them to Juejin/ByteDance infrastructure automatically. In a skill context, this is more sensitive because a user may intend format conversion or draft creation without realizing that local file contents are being exfiltrated off-system as part of the workflow.

Static analysis

No suspicious patterns detected.