wechat-toolkit

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt includes examples that embed API credentials directly in commands (e.g., WECHAT_APP_ID/WECHAT_APP_SECRET passed inline) and shows plaintext export placeholders, which encourages or requires the LLM to produce or reproduce secret values verbatim (high exfiltration risk).

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). 在“搜索(-c/--fetch-content)”工作流中，脚本会运行时抓取搜狗/微信页面的正文文本（search_wechat.js → fetchArticleContent() → cheerio.load(resp.text) → $('#js_content').text()），这些内容属于第三方公众号作者的自由文本，并可能被后续“洗稿/改写”步骤读入LLM上下文。

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The publisher script (scripts/publisher/publish.js) will run "npm install -g @wenyan-md/cli" at runtime if wenyan-cli is missing, which fetches and installs code from the npm registry (e.g. https://registry.npmjs.org/@wenyan-md/cli) and therefore executes remote code during skill runtime.