Security audit

Weixin Multi-Agent Router｜微信多 Agent 路由

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only skill for designing a Weixin multi-agent router, with expected session-state guidance and no hidden execution or data exfiltration behavior.

Before installing or using this skill to build a router, make command matching explicit, consider confirmation for reset actions, and document which locale and aliases your deployment supports. No evidence was found of hidden execution, credential handling, persistence hooks, or exfiltration.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The manifest description is extremely broad and includes many common Weixin integration scenarios, which can cause the skill to activate for ordinary requests that only partially relate to multi-agent routing. Over-broad activation increases the chance of misrouting user intent, pulling in irrelevant instructions, and causing unintended changes in contexts where the user did not ask for this specific architecture.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill hardcodes Chinese command examples as the expected command surface without offering locale selection or stating that the skill is Chinese-only. This can cause incorrect assumptions in multilingual deployments, leading to command mismatch, routing failures, or accidental non-recognition of administrative commands such as reset or handoff.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The status triggers include very common conversational phrases such as '你是谁', which can easily appear in ordinary chat and be interpreted as router commands instead of user intent directed at the active agent. In a multi-agent Weixin router, this can cause accidental disclosure of routing state or unexpected mode changes in the middle of a conversation, reducing reliability and potentially exposing internal agent configuration.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Reset commands like '重置当前', '清空当前上下文', '清空{agent}', and '只重置{agent}' are destructive operations expressed with short natural-language phrases that may be triggered unintentionally or spoofed in normal conversation. In this skill's context, per-agent session isolation and handoff behavior make context integrity important, so accidental resets can erase conversation state, break routing continuity, and sabotage downstream agent behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file specifies exact user messages in Chinese (切换到{agent}, 当前是谁}) as required validation inputs, which implies a fixed-language interaction model. Because no alternative language option or justification for a Chinese-only locale is provided, this appears to violate the language/locale policy for natural-language instructions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The instruction to send 交给{agentB} requires a specific Chinese-language command for handoff testing. The file does not indicate that this is a region-specific skill or that users can choose another language, so the natural-language guidance enforces a locale without opt-in.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The summary-view trigger set includes broad phrases such as '查看摘要', which can reasonably occur in ordinary conversation and may invoke router-level summary access unexpectedly. Because summaries may contain condensed prior context from an agent session, unintended invocation could expose internal conversation state or create confusing behavior for users expecting a normal agent response.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The example configuration uses only Chinese display names, descriptions, and aliases, which can imply a language-specific default in guidance intended for a general shareable skill. Because the document does not offer language choice or explain a region-specific constraint, this may conflict with language/locale policy expectations.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.