WeChat MP Publish Toolkit

• Outcome: Review
• Latest audit: Jul 18, 2026 · 8:14 AM UTC
• Version: 1.0.0

Overview

This is a disclosed WeChat publishing toolkit, but it can use account secrets to automatically publish or delete official-account content without built-in confirmation controls.

Install only if you are comfortable giving the agent WeChat Official Account publishing authority. Keep the credential file locked down, prefer manual approval before recurring auto-publish runs, verify every media_id before publishing, and avoid using the delete helper unless you have confirmed the target draft.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (13)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill instructs use of local files, shell commands, and outbound network/API operations, but it does not declare any permissions or capability boundaries. This is dangerous because users and platforms cannot accurately assess or constrain what the skill can access, increasing the chance of unintended file access, secret exposure, or uncontrolled external calls during execution.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The template instructs an automation to execute shell commands (`date`, `curl`, and potentially a Python script) rather than confining actions to a narrowly scoped publishing interface. In an automation context, command execution increases attack surface because later prompt or placeholder manipulation can turn a content-publishing workflow into local command execution and data access beyond the stated business need.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The template tells the automation to read local files from user-supplied paths, including a daily status JSON and a credential `.env` file. Allowing arbitrary path substitution can expose unrelated local files or secrets if the placeholders are misconfigured, maliciously edited, or influenced by untrusted input.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: publish_draft sends a freepublish request directly to all subscribers with no built-in confirmation, dry-run mode, or guardrail. In an agentic context, a mistaken invocation, prompt confusion, or unsafe automation could trigger an unintended mass publication that is difficult to retract and can cause reputational or operational harm.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: delete_draft performs a destructive API action without any confirmation, soft-delete behavior, or validation beyond accepting a media_id. In automation or agent use, a wrong identifier or accidental call can irreversibly remove content from the draft box and disrupt publication workflows.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Step 4: Publish the draft
1. Get access_token:
   curl -s "https://api.weixin.qq.com/cgi-bin/token?grant_type=client_credential&appid=APPID&secret=SECRET"
2. If errcode=40164 (IP whitelist): get server IP with `curl -s https://api.ipify.org` and notify the user to add it to the whitelist.
3. Call publish API:
   curl -X POST "https://api.weixin.qq.com/cgi-bin/freepublish/submit?access_token=TOKEN" \

• Confidence: 84% confidence
• Finding: The same step also instructs calling `https://api.ipify.org` to disclose the server's public IP to a third party when whitelist errors occur. That outbound disclosure is not strictly required for publishing and leaks infrastructure metadata to an external service outside the core vendor boundary.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Step 4: Publish the draft
1. Get access_token:
   curl -s "https://api.weixin.qq.com/cgi-bin/token?grant_type=client_credential&appid=APPID&secret=SECRET"
2. If errcode=40164 (IP whitelist): get server IP with `curl -s https://api.ipify.org` and notify the user to add it to the whitelist.
3. Call publish API:
   curl -X POST "https://api.weixin.qq.com/cgi-bin/freepublish/submit?access_token=TOKEN" \

• Confidence: 84% confidence
• Finding: The same step also instructs calling `https://api.ipify.org` to disclose the server's public IP to a third party when whitelist errors occur. That outbound disclosure is not strictly required for publishing and leaks infrastructure metadata to an external service outside the core vendor boundary.

External Transmission

Medium

• Category: Data Exfiltration

Content

result = subprocess.run(
        [
            "curl", "-s", "-X", "POST",
            f"https://api.weixin.qq.com/cgi-bin/draft/add?access_token={token}",
            "-H", "Content-Type: application/json",
            "--data-binary", f"@{json_path}",
        ],

• Confidence: 83% confidence
• Finding: The script writes full article HTML to a predictable temporary file and then transmits it to an external service. In a publishing skill this is expected behavior, but it becomes a real security issue when the HTML may contain sensitive internal content and the temp file in a shared temp directory can be read or replaced by other local users before transmission.

External Transmission

Medium

• Category: Data Exfiltration

Content

require_env WECHAT_SECRET || return 1

    local response
    response=$(curl -s "https://api.weixin.qq.com/cgi-bin/token?grant_type=client_credential&appid=${WECHAT_APPID}&secret=${WECHAT_SECRET}")

    local errcode
    errcode=$(echo "$response" | jq -r '.errcode // 0')

• Confidence: 86% confidence
• Finding: The script places WECHAT_SECRET directly in the token request URL query string. Secrets in URLs are often exposed via shell history, process listings, debugging output, proxies, or upstream logs, which increases credential leakage risk even though the destination is legitimate.

Unvalidated Output Injection

High

• Category: Output Handling

Content

def get_access_token(appid, secret):
    """Get WeChat access_token. Handle IP whitelist error (40164)."""
    result = subprocess.run(
        [
            "curl", "-s",
            f"https://api.weixin.qq.com/cgi-bin/token?grant_type=client_credential&appid={appid}&secret={secret}",

• Confidence: 79% confidence
• Finding: The script places appid and secret directly into the curl URL passed as a subprocess argument. Even without shell injection, command-line arguments can often be observed by other local users or monitoring tools via process listings, which can expose long-lived API credentials and enable unauthorized access to the WeChat account.

Credential Access

High

• Category: Privilege Escalation

Content

export WECHAT_APPID="wx_your_appid"
export WECHAT_SECRET="your_secret"

# Get access token
TOKEN=$(get_wechat_token)

# Upload cover image (returns media_id)

• Confidence: 88% confidence
• Finding: The skill handles highly sensitive credentials and access tokens through environment files and shell exports, then uses them in scripts and shell functions. This is dangerous because secrets may be exposed through shell history, process inspection, logs, misconfigured file permissions, or accidental reuse by other commands, enabling unauthorized control of the WeChat account.

Credential Access

High

• Category: Privilege Escalation

Content

- If the file exists: read the `media_id` field.

### Step 3: Load credentials
Read the .env file at {ENV_FILE_PATH} for WECHAT_APPID and WECHAT_SECRET.

### Step 4: Publish the draft
1. Get access_token:

• Confidence: 96% confidence
• Finding: The template explicitly directs the automation to read a local `.env` file containing `WECHAT_APPID` and `WECHAT_SECRET`. This is dangerous because automations that can read raw secret files can accidentally expose credentials through logs, error messages, prompt injection side effects, or path substitution to other sensitive files.

Credential Access

High

• Category: Privilege Escalation

Content

| Placeholder | Description | Example |
|-------------|-------------|---------|
| `{DRAFT_STATUS_PATH}` | Directory where daily draft JSON files are stored | `/Users/friend/articles/drafts` |
| `{ENV_FILE_PATH}` | Path to the .env credential file | `/Users/friend/.wechat-mp.env` |

---

• Confidence: 87% confidence
• Finding: The placeholder documentation normalizes passing an arbitrary path to a `.env` credential file, which encourages insecure secret handling patterns and increases the chance of overbroad filesystem access. While this line is documentation rather than executable logic, it reinforces a design that exposes credentials through local file reads.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/api-guide.md:14