Security audit

WeChat Draft Publisher

Security checks across malware telemetry and agentic risk

Overview

This skill coherently automates WeChat article drafting with configured credentials, with a documented optional publish command users should treat carefully.

Install only if you want this skill to use your configured WeChat official account. Keep config.json and environment variables private, use a trusted image API provider, avoid confidential article text or prompts, review drafts in the WeChat backend, pin patched dependency versions for production, and use --publish only when you intentionally want to submit content for publication.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill declares no permissions, yet its instructions clearly require access to environment variables, local files, and networked services. This creates a transparency and policy-enforcement gap: users and the platform may not realize the skill can read configuration state and perform external publication actions. In context, that mismatch is risky because the skill can write content and send it to external WeChat/image APIs.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The documented behavior says the skill publishes to the WeChat draft box, but the underlying behavior reportedly also supports direct publication via a --publish path. That is a significant safety boundary violation: a user may expect reversible draft creation while the code may perform a live publish action. In this context, unintended public posting to an official account can cause reputational, legal, and operational damage.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The README repeatedly frames the skill as publishing only to the WeChat draft box, but the documented `--publish` flag indicates it can perform immediate publication. This mismatch is security-relevant because users may authorize or install the skill under a lower-risk assumption, while the actual capability allows live content release to a public channel.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The skill metadata promises publication to the WeChat draft box, but the code also supports immediate submission for publishing via the --publish flag. In an agent context, this capability expansion is security-relevant because it can cause unintended external side effects beyond what the user or platform expects, increasing the risk of unauthorized or premature content publication.

Description-Behavior Mismatch

Medium

Confidence: 98% confidence
Finding: The skill description says it only publishes to the WeChat draft box, but this module includes a callable method that submits a draft for publication via the freepublish endpoint. That scope mismatch is dangerous because an agent or downstream component could trigger a public-facing action the user did not expect, causing unauthorized publication and reputational or business harm.

Description-Behavior Mismatch

Low

Confidence: 89% confidence
Finding: The module docstring explicitly states support for publishing drafts, which conflicts with the stated draft-box-only behavior of the skill. Even though this is documentation, it signals implemented capability beyond the declared scope and increases the chance of unsafe integration or accidental use of publishing functionality.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The README describes automatic article generation, image generation, upload, and draft creation, but does not prominently warn that user-provided content may be transmitted to multiple external services, including WeChat and optional image-generation providers. This can lead to unintended disclosure of sensitive prompts, article drafts, or business content to third parties.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger phrases are broad ordinary writing requests such as '写xxx' and '帮我写一篇关于xxx的文章', which can overlap with normal chat usage. In a skill that can upload content externally, broad triggering increases the risk of accidental invocation and unintended transmission or publication actions without the user's clear informed intent.

Vague Triggers

High

Confidence: 92% confidence
Finding: The trigger phrases are broad enough to match common writing requests like '写xxx', causing the skill to activate in situations where the user may only want drafting help, not external publication workflow. In context, this is especially dangerous because invocation can lead to file operations, API calls, and posting content to a WeChat draft box without a narrowly scoped trigger. Over-broad activation increases the chance of unintended side effects.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill description emphasizes one-click automation but does not prominently warn that it may save content externally to a WeChat draft box and invoke third-party image-generation APIs. That weak disclosure undermines informed user consent for external data transfer and publication-related side effects. In this context, article content may be sensitive, proprietary, or reputationally important.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The downloader fetches and writes arbitrary content from a URL returned by the upstream image API without validating the scheme, host, content type, or size. If the upstream service is compromised or misconfigured, this can enable SSRF-like internal network access from the host or disk/resource exhaustion by downloading unexpected or oversized content.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: Submitting a draft for publication is a consequential external action that can make content publicly visible, yet this method performs it directly with no confirmation, approval check, or policy guard. In the context of a skill advertised as draft-box-only, this is especially dangerous because it can violate user intent and trigger unauthorized publication.

Unpinned Dependencies

Low

Category: Supply Chain
Content: requests>=2.28.0 Pillow>=9.0.0
Confidence: 93% confidence
Finding: requests>=2.28.0

Unpinned Dependencies

Low

Category: Supply Chain
Content: requests>=2.28.0 Pillow>=9.0.0
Confidence: 95% confidence
Finding: Pillow>=9.0.0

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High

Category: Supply Chain
Confidence: 97% confidence
Finding: requests

Known Vulnerable Dependency: Pillow — 10 advisory(ies): CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +7 more

Critical

Category: Supply Chain
Confidence: 99% confidence
Finding: Pillow

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.