WeChat MP Publisher

• Outcome: Review
• Latest audit: Jul 18, 2026 · 8:14 AM UTC
• Version: 1.0.0

Overview

This skill is coherent for WeChat publishing, but it can automatically publish irreversible posts using stored account credentials without a built-in confirmation step.

Review before installing. Use it only if you intentionally want an agent or scheduled automation to manage a WeChat Official Account. Store the AppID/AppSecret carefully, restrict .env file permissions, avoid logging commands or tokens, and add your own confirmation, dry-run, or allowlist before any scheduled publish. Treat every publish action as an immediate broadcast to all subscribers.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (8)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The skill documents use of file read/write, shell commands, and network access, but does not declare permissions or boundaries for those capabilities. That creates a transparency and policy-enforcement gap: an agent may invoke powerful operations such as reading env files, calling external APIs, or running shell commands without the user or platform having an explicit permission model to review or constrain them.

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The trigger list includes broad phrases such as 'publish to WeChat', 'auto-publish', and '公众号发布', which can match ordinary user requests without enough context or confirmation. Over-broad activation can cause the skill to be selected in situations involving real outbound publishing, increasing the risk of unintended content posting to subscribers or misuse of stored credentials.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script performs an irreversible publish-to-all-subscribers action immediately once invoked, without any interactive confirmation, dry-run mode, or allowlist check. In automation or agent-driven contexts, this increases the risk of accidental mass publication, misuse of the wrong media_id, or unintended content release.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script exposes a one-call function that publishes a draft to all subscribers without any guardrail such as an interactive confirmation, dry-run mode, environment gate, or explicit warning at call time. In the context of an automation skill for scheduled publishing, this increases the chance of accidental mass publication from bad inputs, misuse by downstream agents, or unintended triggering.

External Transmission

Medium

• Category: Data Exfiltration

Content

result = subprocess.run(
        [
            "curl", "-s",
            f"https://api.weixin.qq.com/cgi-bin/token?grant_type=client_credential&appid={appid}&secret={secret}",
        ],
        capture_output=True,
        text=True,

• Confidence: 90% confidence
• Finding: The script sends the app secret in the URL query string when requesting an access token. Secrets placed in URLs can be exposed through process listings, proxy logs, shell history, monitoring systems, or diagnostic output, increasing the chance of credential disclosure.

Unvalidated Output Injection

High

• Category: Output Handling

Content

def get_access_token(appid, secret):
    """Get WeChat access_token. Handle IP whitelist error (40164)."""
    result = subprocess.run(
        [
            "curl", "-s",
            f"https://api.weixin.qq.com/cgi-bin/token?grant_type=client_credential&appid={appid}&secret={secret}",

• Confidence: 87% confidence
• Finding: The script interpolates appid and secret into the request URL passed as a process argument to curl. Even without shell injection, placing secrets on the command line can expose them to local users, process monitors, debugging tools, shell history wrappers, or operational logs, leading to credential disclosure.

Credential Access

High

• Category: Privilege Escalation

Content

export WECHAT_APPID="wx_your_appid"
export WECHAT_SECRET="your_secret"

# Get access token
TOKEN=$(get_wechat_token)

# Upload cover image (returns media_id)

• Confidence: 93% confidence
• Finding: The skill instructs users to export long-lived secrets and obtain an access token in shell context, which increases the chance that credentials are exposed through shell history, process environments, logs, screenshots, or downstream tooling. Because these credentials authorize publishing actions to an official account, exposure could let an attacker publish unauthorized content or abuse the account API.

Credential Access

High

• Category: Privilege Escalation

Content

- If the file exists: read the `media_id` field.

### Step 3: Load credentials
Read the .env file at {ENV_FILE_PATH} for WECHAT_APPID and WECHAT_SECRET.

### Step 4: Publish the draft
1. Get access_token:

• Confidence: 78% confidence
• Finding: The template explicitly instructs an automation to read WECHAT_APPID and WECHAT_SECRET from a plaintext .env file. In an agentic automation context, this increases the chance that secrets are accidentally exposed through logs, prompt traces, workspace access, or overly broad file-reading behavior, especially because no safeguards or redaction requirements are stated.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/api-guide.md:14