wechat-publish-pro

• Analyzed: May 2, 2026, 9:06 AM
• Findings: 1
• Version: 0.3.0
• Hash: e1beb7e48f5319f49e550d36014da5945c8da4f8071e9d1ed01f9948e8291360
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill contains a shell injection vulnerability in `scripts/publish.sh` where the `eval` command is used on variables ($file, $title, $cover) that are not sufficiently sanitized, potentially allowing arbitrary command execution if filenames or titles are maliciously crafted. Additionally, `src/wechat_publish_pro/converter/__init__.py` includes logic to send article content to a third-party service (api.mdnice.com) for conversion, which may pose a privacy risk. While these appear to be design flaws or functional choices rather than intentional malware, they represent a high-risk attack surface.