Wechat Native Publisher

• Outcome: Pass
• Latest audit: Sep 9, 2026 · 2:51 AM UTC
• Version: 1.0.5

Overview

This skill does what it claims: formats articles and creates WeChat drafts, with sensitive actions disclosed and user-directed.

Install only if you are comfortable giving the skill access to your WeChat public-account draft API credentials and article assets. Use --config with a dedicated credential file, avoid placing secrets inside the skill directory, do not use --build with untrusted Python modules, and avoid --no-validate or --force unless you have manually reviewed the output.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill advertises and instructs use of capabilities including environment-variable access, local file reads/writes, shell execution, and outbound network calls, but the metadata shown in SKILL.md does not declare permissions for those operations. That mismatch is a real security issue because users and enforcement systems cannot accurately assess or constrain what the skill can do, especially since it handles credentials, reads local content/config files, writes previews/temp files, and connects to WeChat and arbitrary image URLs.

Intent-Code Divergence

Low

• Confidence: 94% confidence
• Finding: The module documentation makes a security promise that credentials are only loaded from an environment variable or the current working directory, but the implementation also falls back to a config.json next to the script. In a shared skill/package context, that extra fallback can cause accidental credential exposure or unintended use of bundled secrets, especially if users rely on the stated contract when distributing the skill.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script dynamically imports a user-specified module via importlib.import_module(args.build), which executes top-level Python code from that module immediately. In a skill context, this is dangerous because invoking the advertised --build feature can become arbitrary local code execution with the privileges of the running user, far beyond merely rendering and pushing article content.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

ap.add_argument("--no-cover-auto", action="store_true", help="缺少封面时不自动生成（直接报错）")
    ap.add_argument("--check-env", action="store_true", help="只做环境自检")
    ap.add_argument("--no-push", action="store_true", help="上传+自检后不建草稿，仅打印正文")
    ap.add_argument("--no-validate", action="store_true", help="跳过发布前自检")
    ap.add_argument("--force", action="store_true", help="自检 BLOCK 时仍继续推送")
    args = ap.parse_args()

• Confidence: 83% confidence
• Finding: Exposing --no-validate allows an operator or upstream agent to skip the publication self-check entirely, defeating a defense layer intended to block noncompliant or unsafe HTML before it is sent to the WeChat draft API. In this skill context, where HTML content and remote images may come from user/AI-generated sources, an easy validation bypass increases the chance of unsafe or policy-violating content being pushed downstream.

Static analysis

No suspicious patterns detected.