Security audit

wechat-publisher

Security checks for vulnerabilities and agentic risk

Overview

This WeChat publishing skill is mostly coherent, but it needs Review because it handles publishing credentials and includes a credential-like AppSecret in its documentation.

Install only after reviewing the credential handling. The publisher should replace the credential-like example with unmistakably invalid placeholders, rotate it if it was ever real, stop printing access-token previews, add actual .env.example/.gitignore files if the docs rely on them, and pin dependencies. If you use it, run it in an isolated environment and provide only WeChat credentials for accounts you intend the skill to create drafts and upload media for.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: CONFIGURATION.md:128
Finding: Credential-Like WeChat AppID and AppSecret Pair Exposed in Documentation
Content: View full analysis
Vulnerability Details

File Location: CONFIGURATION.md, lines 128-129
Vulnerability Type: Hardcoded credential exposure
Risk Level: High if the documented credential pair is valid

Vulnerable Code

Documentation table excerpt with labels translated to English and credential values preserved verbatim:

markdown
| `app_id` | WeChat AppID | "wx94029d52b0b25543" | | `app_secret` | WeChat AppSecret | "583856bd1c7075ffdd2e9f9bd415a0c2" |

Technical Analysis

The documentation contains an AppID and AppSecret pair that exactly satisfies the validation rules implemented in scripts/credential_manager.py: an AppID beginning with wx followed by 16 lowercase alphanumeric characters, and a 32-character hexadecimal AppSecret.

The repository does not establish that these values are synthetic, revoked, or otherwise unusable. Publishing a credential pair in documentation can expose the associated WeChat account if it is or was operational. The project correctly warns users against committing secrets, but that guidance does not mitigate a credential-like value already present in a tracked file.

Attack Path

An attacker reads the AppID and AppSecret from CONFIGURATION.md.

The attacker submits them to the official WeChat token endpoint: https://api.weixin.qq.com/cgi-bin/token.

If the pair is valid and the request originates from an allowed IP address, WeChat returns an access token.

The attacker uses the token to invoke API operations enabled for the account, potentially including material uploads and draft creation.

The attacker retains access until the secret or issued token is rotated or expires.

Exploitation depends on the credentials being valid, the account's API permissions, and WeChat IP allowlist restrictions.

Impact Assessment

A successful attacker could obtain the API privileges assigned to the affected WeChat account. Within the functionality demonstrated by ...[truncated 397 chars]
Remediation: View remediation
Remediation Suggestions

Immediately determine whether the documented AppID and AppSecret were ever operational.

If they were real, rotate the AppSecret through the WeChat administration console and invalidate related access where possible.

Replace both values with unmistakably invalid placeholders that cannot satisfy application validation, such as:
text
app_id: "REPLACE_WITH_WECHAT_APP_ID" app_secret: "REPLACE_WITH_WECHAT_APP_SECRET"

Scan the complete Git history, release archives, package registries, and published documentation for the same values.

Add automated secret scanning to CI and pre-commit checks.

Keep real credentials in protected environment variables or a dedicated secrets manager rather than tracked JSON or documentation files.

Ensure .env, my_accounts.json, config.json, and multi_account_config.json are excluded from version control.

T08 · Insecure Dependencies

Warning

Location: requirements.txt:1
Finding: Unpinned Third-Party Dependencies and Browser Runtime
Content: View full analysis
Vulnerability Details

File Location: requirements.txt, lines 1-3
Additional Location: README.md, lines 25-26
Vulnerability Type: Unrestricted dependency resolution and supply-chain exposure
Risk Level: Medium

Vulnerable Code

text
requests>=2.28.0 playwright>=1.30.0 python-dotenv>=1.0.0

The installation instructions also use unconstrained package and browser installation:

bash
pip install requests playwright playwright install chromium

Technical Analysis

All Python dependencies use open-ended minimum-version constraints. Consequently, installations performed at different times may resolve to materially different and unreviewed releases. The README further instructs users to install unconstrained package versions and download a Chromium runtime through Playwright.

Python package installation can execute package build or installation logic with the privileges of the installing user. The Playwright command also downloads an executable browser artifact. Without exact version locks, artifact hashes, or a documented trusted package source, the installed code is not reproducible and may change after the Skill has been reviewed.

This finding does not establish that the currently named dependencies are malicious. The risk arises from allowing future or otherwise unreviewed dependency and browser releases to enter the execution environment automatically.

Attack Path

An attacker compromises a dependency release channel, a package maintainer account, package-index resolution, or a browser artifact distribution path.

A user follows the documented installation procedure or runs pip install -r requirements.txt.

The package resolver selects the affected release because no upper bound or exact version is specified.

Installation logic or the downloaded browser artifact introduces attacker-controlled code.

That code executes during installation or later wh ...[truncated 557 chars]
Remediation: View remediation
Remediation Suggestions

Pin every Python dependency to a reviewed exact version instead of using open-ended minimum constraints.

Generate a lock file containing cryptographic hashes, for example through pip-tools, and install with hash verification.

Update the README so installation uses the reviewed lock file rather than unconstrained package names.

Pin the Playwright package and its compatible Chromium revision as a tested unit.

Install packages only from an explicitly configured trusted index over TLS.

Perform dependency updates through a controlled review process with vulnerability scanning and automated tests.

Install and execute the Skill in an isolated virtual environment or container with access limited to the files and credentials required for WeChat publishing.

Avoid running dependency installation as an administrator or root user.

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (58)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: 声明描述的是一个完整的微信公众号内容创作与发布系统，但实际代码片段没有体现这些核心能力。该脚本既未访问微信公众号相关接口，也未处理账号、发布流程、封面生成或内容生成逻辑；其唯一行为是输出一条加载信息。虽然文件名和注释提到“生成文章内容”，但代码本身并未实现与声明相符的功能，因此描述与实际行为存在明显不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: 声明描述的是一个覆盖“多公众号管理 + 内容创作 + 封面设计 + 自动发布 + 状态查看”的完整技能，但给出的代码块只涉及微信 API 的基础发布辅助功能。具体来说，代码能通过 CredentialManager 按 account_id 获取凭证，说明有一定多账号凭证支持，但没有看到真正的账号切换流程、账号列表管理或状态查询；上传封面图只是上传本地图片到微信服务器，并不等于‘封面设计’；publish_draft 只是添加到草稿箱，不是正式群发/自动发布；也没有任何文章内容生成逻辑或发布情况查询逻辑。因此，代码实际能力明显窄于声明的核心能力范围，属于描述与行为不一致。
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · TEST_GUIDE.md (reported line 330)May include surrounding context.
bash
# 删除包含真实AppSecret的配置文件 rm references/my_accounts.json rm references/config.json

检查是否有敏感文件残留

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/credential_manager.py (reported line 33)May include surrounding context.
python
try: from dotenv import load_dotenv # 加载 .env 文件 env_file = Path(__file__).parent.parent / ".env" if env_file.exists(): load_dotenv(env_file) except ImportError:

Credential Access

High

Category: Privilege Escalation
Confidence: 89% confidence
Finding: The script prints the first 10 characters of the access token, which is a partial secret disclosure. Even partial credential leakage can aid token correlation across logs, expose active session material, and violate least-exposure practices in shared terminals, CI logs, or agent traces.
Content: Scanner excerpt · scripts/publish_to_wechat.py (reported line 55)May include surrounding context.
python
if 'access_token' in data: # 不打印完整token，只显示前10个字符 token_preview = data['access_token'][:10] + "****" print(f"✅ Access Token获取成功: {token_preview}") return data['access_token'] else: error_msg = data.get('errmsg', '未知错误')

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/publish_to_wechat.py (reported line 59)May include surrounding context.
python
return data['access_token'] else: error_msg = data.get('errmsg', '未知错误') safe_print_error(Exception(error_msg), "获取Access Token") return None except requests.exceptions.Timeout:

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/publish_to_wechat.py (reported line 176)May include surrounding context.
python
print("❌ 凭证格式无效") return False # 获取access token token = get_access_token(app_id, app_secret) if token:

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 35)May include surrounding context.
bash
# 复制模板文件 cp .env.example .env # 编辑 .env 文件 WECHAT_APP_ID_1=你的AppID

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · çæ¬æ´æ°è¯´æ-v1.1.0.md (reported line 21)May include surrounding context.
bash
# 复制模板文件 cp .env.example .env # 编辑 .env 文件 WECHAT_APP_ID_1=你的AppID

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · çæ¬æ´æ°è¯´æ-v1.1.0.md (reported line 108)May include surrounding context.
bash
# 复制模板文件 cp .env.example .env # 编辑 .env 文件 WECHAT_APP_ID_1=你的AppID

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · çæ¬æ´æ°è¯´æ-v1.1.0.md (reported line 130)May include surrounding context.
bash
# 复制模板文件 cp .env.example .env # 编辑 .env 文件 WECHAT_APP_ID_1=你的AppID

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 206)May include surrounding context.
复制模板文件

cp .env.example .env

编辑 .env 文件

WECHAT_APP_ID_1=你的AppID WECHAT_APP_SECRET_1=你的AppSecret

text

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/credential_manager.py (reported line 32)May include surrounding context.
python
# 复制模板文件 cp .env.example .env # 编辑 .env 文件 WECHAT_APP_ID_1=你的AppID WECHAT_APP_SECRET_1=你的AppSecret ```

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/publish_to_wechat.py (reported line 191)May include surrounding context.
python
# 复制模板文件 cp .env.example .env # 编辑 .env 文件 WECHAT_APP_ID_1=你的AppID WECHAT_APP_SECRET_1=你的AppSecret ```

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · çæ¬æ´æ°è¯´æ-v1.1.0.md (reported line 23)May include surrounding context.
复制模板文件

cp .env.example .env

编辑 .env 文件

WECHAT_APP_ID_1=你的AppID WECHAT_APP_SECRET_1=你的AppSecret

text

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · çæ¬æ´æ°è¯´æ-v1.1.0.md (reported line 109)May include surrounding context.
复制模板文件

cp .env.example .env

编辑 .env 文件

WECHAT_APP_ID_1=你的AppID WECHAT_APP_SECRET_1=你的AppSecret

text

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · çæ¬æ´æ°è¯´æ-v1.1.0.md (reported line 129)May include surrounding context.
复制模板文件

cp .env.example .env

编辑 .env 文件

WECHAT_APP_ID_1=你的AppID WECHAT_APP_SECRET_1=你的AppSecret

text

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · TEST_GUIDE.md (reported line 329)May include surrounding context.
WECHAT_APP_SECRET_1=你的AppSecret

4. （可选）删除配置文件

rm references/my_accounts.json

text
## 版本对比

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · çæ¬æ´æ°è¯´æ-v1.1.0.md (reported line 137)May include surrounding context.
WECHAT_APP_SECRET_1=你的AppSecret

4. （可选）删除配置文件

rm references/my_accounts.json

text
## 版本对比

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file forces a specific language for all instructions, examples, and commands, and does not provide an opt-in, alternative language, or justification that the skill is intended only for Chinese-speaking users. This can violate language/locale policy when users are not given a choice.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The invocation examples are broad, everyday phrases like '写一篇文章' and '查看发布情况', which can match common user requests without clearly constraining that they are intended for this specific publishing skill. In a skill capable of switching accounts and publishing content, ambiguous triggers increase the risk of unintended activation and accidental progression into sensitive workflows.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill instructs the agent to read configuration files containing AppID/AppSecret, write article and log files, and perform network actions such as uploading media and calling the WeChat API, but it does not declare any explicit tool scope or permissions boundaries. In a capability-based agent system, this mismatch is dangerous because the skill could gain broad file, environment, and network access without transparent restriction, increasing the risk of secret exposure or unauthorized publishing.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The top-level description says the skill auto-triggers whenever users mention generating content, covers, or publishing for public accounts, but it does not define clear boundaries for when activation should not occur. Because the skill's documented workflow includes accessing private configs and external publishing actions, vague activation criteria materially increase the chance of unintended sensitive operations.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Broad trigger phrases like '今天要发公众号' or '今天要发微信' can cause the skill to auto-activate in loosely related conversations, which is risky because this skill handles sensitive account configs, file writes, and publishing workflows. In context, accidental activation could steer the agent into reading secrets, switching accounts, or preparing publication actions when the user only meant casual discussion.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: SQP-3 applies to all file types and covers language or locale policy violations. The guide consistently assumes Chinese as the required interaction language, with no opt-in, multilingual alternative, or stated reason that the skill is intentionally limited to Chinese-speaking or region-specific use.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

T08 · Insecure Dependencies

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

SkillSpector

Tp4

Tp4

Tool Parameter Abuse

检查是否有敏感文件残留

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

复制模板文件

编辑 .env 文件

Credential Access

Credential Access

Credential Access

复制模板文件

编辑 .env 文件

Credential Access

复制模板文件

编辑 .env 文件

Credential Access

复制模板文件

编辑 .env 文件

Tool Parameter Abuse

4. （可选）删除配置文件

Tool Parameter Abuse

4. （可选）删除配置文件

Natural-Language Policy Violations

Vague Triggers

Undeclared Tool Scope

Vague Triggers

Vague Triggers

Natural-Language Policy Violations

Static analysis