Zhy Wechat Writing

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:02 AM UTC
• Version: 0.1.0

Overview

The skill is a coherent WeChat article workflow, but it defaults to uploading generated content to external services and a WeChat draft box without a clear per-run opt-in.

Install only if you are comfortable with a workflow that may send generated drafts, images, and metadata to external providers and WeChat by default. Before use, set post_to_wechat to false unless you intentionally want a remote draft, review auxiliary skill credentials, and prefer a pinned commit or release for installation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:93

Finding

Remote WeChat draft upload is enabled by default

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:93-96
Vulnerability Type: Unsafe default network publishing behavior
Risk Level: Medium

yaml

- name: post_to_wechat
  type: boolean
  required: false
  default: true

Technical Analysis

The Skill describes WeChat draft publishing as an optional enhancement, but the corresponding option defaults to true. Therefore, a user requesting only article generation may trigger the publishing workflow without explicitly opting in.

When the required auxiliary publishing Skill and credentials are available, the workflow invokes the WeChat API and uploads the generated HTML article and embedded images. The wider publishing instructions also permit transmission of metadata such as the title, author, digest, and source URL.

Network publishing is not necessary for the Skill's minimum declared writing functionality. Enabling it by default violates least-privilege and explicit-consent principles. The reviewed project does not include the auxiliary publishing scripts, so direct exfiltration of WECHAT_APP_SECRET or other credentials cannot be confirmed.

Attack Path

1. The user requests generation of a WeChat article without specifying post_to_wechat.
2. The Skill applies the default value of true.
3. The workflow generates an HTML version of the article.
4. If the external publishing Skill and WeChat credentials are configured, the Skill invokes the publishing helper.
5. The helper sends the article, images, and associated metadata to the WeChat API.
6. A remote draft record is created without an explicit upload decision for that invocation.

Impact Assessment

The behavior can disclose unpublished article content, locally generated images, source-derived material, and publication metadata to WeChat. It can also create or modify remote draft-box state using the configured account credentials.

This finding does not demonstrate operating-syst ...[truncated 197 chars]

Remediation

View remediation

Remediation Suggestions

• Change post_to_wechat to default to false.
• Require an explicit per-invocation opt-in before running any publishing helper.
• Add a confirmation step immediately before upload that identifies:
  • The destination WeChat account or tenant.
  • The article and image files that will be uploaded.
  • The metadata fields that will be transmitted.
• Separate article generation from publishing so the core workflow does not require remote-write privileges.
• Use narrowly scoped publishing credentials and keep them accessible only to the publishing helper.
• Provide a dry-run mode that displays the intended request without transmitting data.
• Record a local audit event for each attempted upload, without logging secrets or access tokens.

T08 · Insecure Dependencies

Warning

• Location: README.md:24

Finding

Installation instructions use mutable and unverified remote dependencies

Content

View full analysis

Vulnerability Details

File Location: README.md:24
Vulnerability Type: Unpinned remote installation source
Risk Level: Medium

bash

npx skills add https://github.com/zhylq/yuan-skills --skill zhy-wechat-writing

Technical Analysis

The documented installation command invokes an npm-resolved CLI and installs the Skill from a GitHub repository without pinning either component to a reviewed version or immutable commit.

A mutable repository branch can change after this audit. Likewise, invoking npx without an explicit package version can resolve a newer CLI release than the version originally intended. The documentation does not provide a commit hash, release checksum, signature, or integrity verification procedure.

This is a supply-chain weakness rather than evidence that the current repository is malicious. Exploitation depends on compromise or unauthorized modification of the npm package, GitHub repository, account, release process, or network resolution path.

Attack Path

1. An attacker compromises the npm package used by npx, the referenced GitHub repository, or an authorized maintainer account.
2. The attacker modifies the installer, Skill instructions, or auxiliary content at the mutable source.
3. A user executes the documented installation command.
4. The command resolves and installs the modified content rather than the version covered by this audit.
5. The installed Skill is subsequently trusted and can supply altered instructions or executable helper content to the Agent.

Impact Assessment

A successful supply-chain compromise could replace the reviewed Skill with attacker-controlled instructions or components. The resulting privileges would depend on the installation framework and Agent environment, potentially including access to Agent tools, local files exposed to the Skill, configured API credentials, and network-capable helper Skills.

No actual upstream compromise, m ...[truncated 156 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the npx CLI to a specific reviewed version.
• Pin the GitHub source to an immutable commit SHA or signed release tag.
• Publish cryptographic checksums for release artifacts and document verification steps.
• Prefer signed releases with verifiable provenance.
• Avoid installation directly from mutable default branches.
• Use lockfiles or equivalent integrity metadata for all resolved dependencies.
• Re-audit the exact pinned artifact whenever the version or commit changes.
• Document the expected repository owner, commit identifier, package version, and checksum in the installation guide.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README states that the workflow can save content to a WeChat draft box, but it does not prominently warn users that enabling this option transmits article content to an external platform. This can lead to unintentional disclosure of unpublished, sensitive, or proprietary material, especially because publishing is presented as a routine optional enhancement in a content-generation workflow.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

post_to_wechat is enabled by default, so using the skill can automatically send generated content to the WeChat draft box without an explicit per-run confirmation. Even though this is not final publication, it is still an external side effect that can leak confidential content, create unintended artifacts in a production publishing account, or trigger compliance issues in organizations handling embargoed or internal material.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill orchestrates multiple external actions—web fetching, image generation via third-party providers, HTML conversion, and upload to the WeChat platform—but does not prominently warn that article content, references, and possibly generated images will be transmitted outside the local environment. In a writing/publishing workflow, this can expose unpublished drafts, proprietary material, or sensitive prompts to external services without clear user awareness or consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The README documents concrete output paths under articles/<slug>/..., indicating the skill creates or overwrites local files. For markdown-file review, this is a user-data/system-impacting behavior that should be disclosed more explicitly as a write operation, not only implied by the output list.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file sets illustration_text_language default to zh-CN and describes the default image text language as simplified Chinese. This is a locale/language policy concern because the skill defaults to a specific language rather than offering a user choice or explicit opt-in in the natural-language guidance.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.