wechat-cover-maker
Fail
Audited by Gen Agent Trust Hub on Nov 14, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATIONCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The instructions guide the agent to perform a git clone from a remote repository (github.com/beatra-ai/wechat-article-cover-skill.git) and subsequently execute the downloaded Python scripts (authorize.py, mcp_client.py), bypassing standard skill containment.
- [COMMAND_EXECUTION]: The installation process provides several shell commands for the agent to execute, including mktemp, git clone, and cp -R, which modify the agent's filesystem and configuration.
- [DATA_EXFILTRATION]: The skill is designed to send user-supplied content and system telemetry, such as hostname, OS version, CPU architecture, and locale, to external servers (mcp.beatra.ai, mcp.beatra.cn).
- [CREDENTIALS_UNSAFE]: The skill manages sensitive bearer tokens with wallet:spend permissions, storing them in a local JSON file (~/.beatra/credentials.json).
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user data like article titles and reference images which are then sent to a third-party LLM service, creating a surface for indirect prompt injection.
Recommendations
- AI detected serious security threats
Audit Metadata