T03 · Remote Payload Retrieval and Execution
Error
- Location
docs/user_guide.md:82- Finding
Privileged Remote Script Download and Immediate Execution
- Content
View full analysis
- Remediation
View remediation
Security audit
微信公众号发布技能
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its stated WeChat draft-publishing purpose, but it handles powerful account credentials and installation steps in ways users should review carefully before installing.
Install only if you are comfortable giving this skill WeChat official account draft-creation authority. Avoid entering AppSecret as a command-line argument, prefer a protected secret store or tightly permissioned local file, rotate the secret if it may have been exposed, and do not run the documented curl | sudo bash or sudo npm install steps without independent verification and version pinning.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T08 · Insecure Dependencies
Error
- Location
docs/user_guide.md:82- Finding
Unpinned Global Package Installation with Elevated Privileges
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
docs/user_guide.md:218- Finding
WeChat Secrets Exposed Through Command Arguments and Plaintext Files
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (27)
Tainted flow: 'params' from os.environ.get (line 147, credential/environment) → requests.get (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python for i in range(1, retry_count + 1): try: self.logger.info(f"获取 Token（尝试 {i}/{retry_count}）") response = requests.get(token_url, params=params, timeout=30) response.raise_for_status() result = response.json()
Tainted flow: 'params' from os.environ.get (line 147, credential/environment) → requests.post (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python for i in range(1, retry_count + 1): try: self.logger.info(f"创建草稿（尝试 {i}/{retry_count}）") response = requests.post( draft_url, params=params, json=data,
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 97% confidence
- Finding
The chained pattern "curl ... | sudo ... bash" combines network retrieval with immediate privileged execution, enabling one-step compromise if the fetched content is malicious or altered. This is especially dangerous in user-facing install docs because readers may execute it verbatim without understanding the trust boundary.
- Content
bash # 1. 打开终端 # 2. 安装 Node.js（如未安装） curl -fsSL https://deb.nodesource.com/setup_16.x | sudo -E bash - sudo apt-get install -y nodejs # 3. 安装 OpenClaw
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The guide instructs users to pass the AppSecret directly as a command-line argument, which commonly exposes credentials via shell history, process listings, audit logs, terminal recording, and support screenshots. For a publishing skill tied to a WeChat account, compromise of this secret can enable unauthorized API access and account abuse.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The guide tells users to store the AppSecret in a plaintext config file and does not prominently warn about access control, secret-at-rest protection, backup leakage, or accidental source-control inclusion. In the context of an automation skill, plaintext storage increases the chance that long-lived credentials are harvested from the filesystem, synced folders, or diagnostic bundles.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The configuration enforces a specific timezone, "Asia/Shanghai", with no indication of user opt-in or a justified region-specific requirement. The audit criteria require flagging locale policy issues when a skill forces a locale without offering a choice or documenting the constraint.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The document requires users to operate through a fully Chinese-language guide and repeatedly uses China-specific locale assumptions such as
Asia/Shanghaiand Beijing-time phrasing, but it does not present this as an opt-in regional edition or offer an alternative language/locale path. Under the stated policy, forcing a specific language or locale without user choice is a natural-language policy concern.- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 92% confidence
- Finding
The command pipes a remote script directly into a root shell via "curl ... | sudo -E bash -", which is a classic high-risk pattern because network compromise, mirror compromise, DNS/TLS interception, or content tampering can become immediate privileged code execution. In installation documentation, this is more dangerous than ordinary sudo use because it removes any review step before executing downloaded code as root.
- Content
bash # 1. 打开终端 # 2. 安装 Node.js（如未安装） curl -fsSL https://deb.nodesource.com/setup_16.x | sudo -E bash - sudo apt-get install -y nodejs # 3. 安装 OpenClaw
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 92% confidence
- Finding
The command pipes a remote script directly into a root shell via "curl ... | sudo -E bash -", which is a classic high-risk pattern because network compromise, mirror compromise, DNS/TLS interception, or content tampering can become immediate privileged code execution. In installation documentation, this is more dangerous than ordinary sudo use because it removes any review step before executing downloaded code as root.
- Content
bash # 1. 打开终端 # 2. 安装 Node.js（如未安装） curl -fsSL https://deb.nodesource.com/setup_16.x | sudo -E bash - sudo apt-get install -y nodejs # 3. 安装 OpenClaw
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md # 1. 打开终端 # 2. 安装 Node.js（如未安装） curl -fsSL https://deb.nodesource.com/setup_16.x | sudo -E bash - sudo apt-get install -y nodejs # 3. 安装 OpenClaw sudo npm install -g openclaw
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md # 1. 打开终端 # 2. 安装 Node.js（如未安装） curl -fsSL https://deb.nodesource.com/setup_16.x | sudo -E bash - sudo apt-get install -y nodejs # 3. 安装 OpenClaw sudo npm install -g openclaw
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The guide includes a full example AppSecret immediately after stating that the secret is sensitive and only displayed once. Even if presented as an example, publishing realistic credential material normalizes unsafe handling and can lead users to copy secrets into screenshots, tickets, chats, or docs; if the example were ever real, it would be a direct credential exposure.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The configuration display example claims the AppSecret is masked but still reveals most of the value, which materially reduces secrecy and teaches an unsafe display pattern. Partial disclosure can aid shoulder-surfing, log leakage, screenshot compromise, or correlation with other exposed fragments.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
npm install -g openclaw
解决方案 2：使用 sudo（macOS/Linux）
sudo npm install -g openclaw
text **Q2: openclaw 命令找不到？**
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # 检查配置文件权限 # macOS/Linux: chmod 600 ~/.agents/skills/wechat-publisher/config/config.json # Windows: 以管理员身份运行配置命令
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script claims to be a publishing utility but also implements unrelated license enforcement and local usage metering. Hidden or undocumented control logic increases supply-chain risk because operators may grant the skill more trust than warranted, and the extra code path can deny service or alter behavior unexpectedly.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The top-level natural-language description is entirely in Chinese and presents the skill as a general-purpose publishing script, but it does not indicate that Chinese is optional or that the tool is restricted to a Chinese-language context. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The script reads sensitive credentials from environment variables or config and immediately uses them to call an external service without any explicit user-facing notice at runtime. In an agent-skill setting, this matters because users may trigger the skill without realizing it will consume locally available secrets and perform network actions on their behalf.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python # 获取新 Token app_secret = self._get_app_secret() token_url = "https://api.weixin.qq.com/cgi-bin/token" params = { "grant_type": "client_credential", "appid": self.config["app_id"],
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python # 获取新 Token app_secret = self._get_app_secret() token_url = "https://api.weixin.qq.com/cgi-bin/token" params = { "grant_type": "client_credential", "appid": self.config["app_id"],
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill contains local license checks and trial tracking that are unrelated to the operational task of drafting WeChat posts. In a security review context, unnecessary gating logic is risky because it adds opaque behavior, local state manipulation, and execution control that users did not ask for.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 80% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python for i in range(1, retry_count + 1): try: self.logger.info(f"创建草稿（尝试 {i}/{retry_count}）") response = requests.post( draft_url, params=params, json=data,
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill advertises automated collection, HTML generation, and scheduled publishing to a WeChat public account draft box, but it does not clearly warn users that generated content may be published automatically on a schedule. This can cause unintended posting, reputational harm, or policy violations if users do not understand the automation scope before configuring or enabling the skill.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill requests sensitive platform credentials (
app_idand especiallyapp_secret) but provides no warning about how those secrets are stored, transmitted, or protected. In the context of a publishing skill tied to an official account, mishandling these credentials could enable unauthorized access, content publication, or takeover of associated API capabilities.- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
This manifest-style JSON file hard-codes the timezone to "Asia/Shanghai", which may act as an implicit locale constraint without clarifying whether the skill is region-specific or configurable. Because the file provides no surrounding documentation or opt-in mechanism here, the setting is ambiguous and could affect behavior outside a narrowly defined context.
- Content