Security audit

Wechat HTML Publisher

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims, but its image handling can read broad local paths and fetch arbitrary URLs before uploading content to WeChat, so users should review it carefully before installing.

Install only if you will publish trusted HTML and understand that article content, metadata, covers, and embedded images are sent to WeChat. Do not run it on HTML from untrusted sources unless the code is changed to restrict local image paths to a dedicated asset folder, block private/internal URLs, validate image types and sizes, and preview exactly what will be uploaded.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/publish_html.py:64
Finding: Arbitrary Local File Read and External Upload Through HTML Image References
Content: View full analysis
]+src=["\']([^"\']+)["\']' def replace_image(match): src = match.group(1) if 'mmbiz.qpic.cn' in src or 'wx.qlogo.cn' in src: return match.group(0) if not src.startswith(('http://', 'https://', '/')): src = os.path.join(html_dir, src) print(f"[UPLOAD] Upload image: {src}") media_id, new_url = self.upload_image(src) if new_url: return match.group(0).replace(match.group(1), new_url) else: print(f"[WARN] Image upload failed, preserving original URL: {src}") return match.group(0) ``` ### Technical Analysis The publisher treats every `src` attribute in an HTML `` element as a trusted image location. Absolute paths are accepted directly, while relative paths are joined to the HTML file's directory without canonicalization or an allowed-directory check. The resulting path is opened with the process's current filesystem privileges. The code performs no validation that: - The canonical path remains under the article's asset directory. - The path does not contain traversal sequences. - The target is a regular file rather than a special file or symbolic link. - The bytes represent a supported image. - The file has an acceptable size. - The operator explicitly authoriz ...[truncated 1962 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/publish_html.py:48
Finding: Server-Side Request Forgery and Internal Response Relay Through Remote Images
Content: View full analysis
]+src=["\']([^"\']+)["\']' def replace_image(match): src = match.group(1) if 'mmbiz.qpic.cn' in src or 'wx.qlogo.cn' in src: return match.group(0) if not src.startswith(('http://', 'https://', '/')): src = os.path.join(html_dir, src) print(f"[UPLOAD] Upload image: {src}") media_id, new_url = self.upload_image(src) if new_url: return match.group(0).replace(match.group(1), new_url) else: print(f"[WARN] Image upload failed, preserving original URL: {src}") return match.group(0) ``` ### Technical Analysis Remote image URLs from both HTML image references and the `--cover` argument are fetched by the publisher without destination validation. The implementation only checks whether the string begins with `http://` or `https://`. It does not prevent requests to: - Loopback addresses such as `127.0.0.1` or `::1`. - Private network ranges. - Link-local addresses. - Cloud instance metadata endpoints. - Internal DNS names. - Reserved or otherwise non-public address ranges. The `requests` library follows redirects by default, and the code d ...[truncated 2339 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: README.md:17
Finding: Unpinned Third-Party Dependency Installation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README tells users to upload HTML articles and images to the WeChat draft system, but it does not clearly disclose that this content will be transmitted to and stored by a third-party service. That omission can cause users to submit sensitive or proprietary material without informed consent, which is a real privacy and data-handling risk in a publishing skill whose core function is external upload.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 96% confidence
Finding: The skill describes capabilities that require reading local files, accessing environment variables, and making network requests, but it does not declare any explicit tool scope or permission boundaries. This is dangerous because users and hosting agents cannot easily evaluate or constrain what the skill may access, increasing the risk of unintended data exposure such as local files, credentials, or outbound transmission of content.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill documentation does not clearly warn that article HTML, local image files, and remote image URLs will be fetched and uploaded to third-party WeChat services. This is dangerous because users may unknowingly transmit sensitive content or cause the agent to fetch attacker-controlled remote resources, creating privacy, data handling, and SSRF-like exposure risks depending on runtime behavior.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/publish_html.py (reported line 21)May include surrounding context.
python
self.app_id = app_id self.app_secret = app_secret self.access_token = None self.base_url = "https://api.weixin.qq.com/cgi-bin" def get_access_token(self): """获取access_token"""

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The tool will fetch arbitrary remote URLs when an image source or cover path begins with http:// or https://. That creates an SSRF-like outbound retrieval capability, allowing a user-supplied HTML file to trigger network access to attacker-controlled hosts, internal services exposed over HTTP(S), or tracking endpoints, which goes beyond simple draft publishing.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script uploads full HTML content, metadata, and referenced images to external WeChat endpoints without an explicit privacy warning or confirmation step. In a publishing tool this is expected behavior, but the lack of transparent notice increases the risk of unintentionally transmitting sensitive local content or externally referenced resources.
Content: No source excerpt is available for this finding.

Tainted flow: 'json_data' from requests.post (line 149, network input) → requests.post (network output)

Medium

Category: Data Flow
Confidence: 65% confidence
Finding: Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
Content: Scanner excerpt · scripts/publish_html.py (reported line 152)May include surrounding context.
python
json_data = json.dumps(data, ensure_ascii=False).encode('utf-8') headers = {'Content-Type': 'application/json; charset=utf-8'} resp = requests.post(url, params=params, data=json_data, headers=headers, timeout=30) resp.raise_for_status() result = resp.json()

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: All visible user-facing documentation in this file is in Chinese, and the file does not indicate that the skill is region-specific or provide an opt-in language choice. Under the stated policy, forcing a specific language without user choice can be a natural-language policy violation unless the locale constraint is documented and justified.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.