Security Audit
jimliu/baoyu-skills:skills/baoyu-post-to-wechat
github.com/jimliu/baoyu-skillsTrust Assessment
jimliu/baoyu-skills:skills/baoyu-post-to-wechat received a trust score of 10/100, placing it in the Untrusted category. This skill has significant security findings that require attention before use in production.
SkillShield's automated analysis identified 10 findings: 5 critical, 2 high, 2 medium, and 1 low severity. Key findings include Network egress to untrusted endpoints, File read + network send exfiltration, Sensitive environment variable access: $HOME.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The Manifest Analysis layer scored lowest at 0/100, indicating areas for improvement.
Last analyzed on August 6, 2026 (commit 6b7a2e41). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings10
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Network egress to untrusted endpoints HTTP request to raw IP address Review all outbound network calls. Remove connections to webhook collectors, paste sites, and raw IP addresses. Legitimate API calls should use well-known service domains. | Manifest | skills/baoyu-post-to-wechat/scripts/wechat-http.test.ts:37 | |
| CRITICAL | Network egress to untrusted endpoints HTTP request to raw IP address Review all outbound network calls. Remove connections to webhook collectors, paste sites, and raw IP addresses. Legitimate API calls should use well-known service domains. | Manifest | skills/baoyu-post-to-wechat/scripts/wechat-socks-http.test.ts:38 | |
| CRITICAL | File read + network send exfiltration SSH key/config file access Remove access to sensitive files not required by the skill's stated purpose. SSH keys, cloud credentials, and browser data should never be read by skills unless explicitly part of their declared functionality. | Manifest | skills/baoyu-post-to-wechat/SKILL.md:66 | |
| CRITICAL | File read + network send exfiltration SSH key/config file access Remove access to sensitive files not required by the skill's stated purpose. SSH keys, cloud credentials, and browser data should never be read by skills unless explicitly part of their declared functionality. | Manifest | skills/baoyu-post-to-wechat/SKILL.md:67 | |
| CRITICAL | SSH Argument Injection leading to Remote Code Execution The `buildSshArgs` function in `scripts/wechat-remote-publish.ts` constructs SSH arguments using configuration values from `EXTEND.md` (such as `remote_publish_user`) without validating that they do not start with a dash (`-`). Because these arguments are passed to `spawn` without a `--` separator, an attacker who can control the `EXTEND.md` file (for example, by submitting a malicious repository or PR) can inject arbitrary SSH options like `-oProxyCommand` via the `remote_publish_user` field, leading to arbitrary command execution when the SSH tunnel is started. Validate that `config.user` and `config.host` do not start with a dash (`-`), or use the `--` separator before passing the destination to `ssh` if the installed `ssh` client supports it. Alternatively, strictly validate that `config.user` only contains alphanumeric characters, dashes, and underscores. | LLM | scripts/wechat-remote-publish.ts:86 | |
| HIGH | Sensitive path access: SSH key/config Access to SSH key/config path detected: '~/.ssh/id_ed25519'. This may indicate credential theft. Verify that access to this sensitive path is justified and declared. | Static | skills/baoyu-post-to-wechat/SKILL.md:66 | |
| HIGH | AppleScript Injection in paste-from-clipboard.ts The `activateApp` and `pasteMac` functions in `scripts/paste-from-clipboard.ts` directly interpolate the `appName` / `targetApp` parameter (supplied via the `--app` command-line argument) into an AppleScript string executed via `osascript`. If an attacker can influence this argument (e.g., via prompt injection or malicious instructions to the LLM agent), they can inject arbitrary AppleScript commands (such as `do shell script`) to execute arbitrary shell commands on macOS. Sanitize the `appName` / `targetApp` argument to ensure it does not contain double quotes, newlines, or other characters that can be used to break out of the AppleScript string literal, or restrict it to a safe whitelist of known application names. | LLM | scripts/paste-from-clipboard.ts:31 | |
| MEDIUM | Sensitive environment variable access: $HOME Access to sensitive environment variable '$HOME' detected in shell context. Verify this environment variable access is necessary and the value is not exfiltrated. | Static | skills/baoyu-post-to-wechat/SKILL.md:37 | |
| MEDIUM | Unpinned npm dependency version Dependency '@jsquash/webp' is not pinned to an exact version ('^1.5.0'). Pin dependencies to exact versions to reduce drift and supply-chain risk. | Dependencies | skills/baoyu-post-to-wechat/scripts/package.json | |
| LOW | Node lockfile missing package.json is present but no lockfile was found (package-lock.json, pnpm-lock.yaml, or yarn.lock). Commit a lockfile for deterministic dependency resolution. | Dependencies | skills/baoyu-post-to-wechat/scripts/package.json |
Scan History
Embed Code
[](https://skillshield.io/report/983d128483db955f)
Powered by SkillShield