baoyu-post-to-wechat

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly tells the agent to prompt for WeChat AppID/AppSecret and write them into a .env (showing the key=value lines), which requires the LLM to accept and embed secret values verbatim in generated output/files, creating an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). This skill clearly downloads and ingests arbitrary public web resources (e.g., scripts/md-to-wechat.ts's downloadFile/resolveImagePath for http/https image URLs and the PlantUML fetchSvgContent calls), and SKILL.md / references/article-posting.md show those fetched resources are incorporated into the conversion/publishing workflow (contentImages/html) that drives automated browser/API actions, so untrusted third‑party content can influence tool actions.