Security audit

智能微信公众号发布技能

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims by creating WeChat drafts, but it needs review because it handles account secrets unsafely, recommends risky privileged installs, and inserts hardcoded/fabricated publishing content.

Install only after reviewing and changing the setup flow: avoid sudo/curl-to-bash instructions, do not put AppSecret in shell history or ordinary shared files, inspect the generated draft before publishing, remove hardcoded footer/author/source claims, and use a restricted WeChat credential that can be rotated.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

Location: docs/user_guide.md:86
Finding: Privileged Execution of an Unverified Remote Installation Script
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: templates/v5-simple.html:62
Finding: Undisclosed Third-Party Branding Is Injected into Published Articles
Content: View full analysis

数据来源

TechCrunch AI · MIT Technology Review · The Verge

心识孤独的猎手

AI 行业前沿资讯 · 每日更新

``` The template is loaded and subsequently uploaded without removing this fixed identity: ```python template = self._load_template() content = template.replace("{DATE}", today_date) ``` ### Technical Analysis The default publication template includes a fixed third-party identity rather than a configurable identity belonging to the user's WeChat account. The publisher loads this template, replaces selected news placeholders, and submits the resulting HTML to the user's WeChat draft account. The fixed branding is not necessary to generate or upload an AI-news draft. It modifies the user's externally visible publication output and is not presented as an explicit opt-in requirement. The same footer also makes fixed source-attribution claims regardless of whether the generated content was actually obtained from those sources. ### Attack Path 1. The user accepts the default `v5-simple` template. 2. The publisher loads the template containing the fixed identity. 3. The preparation routine replaces only designated placeholders and leaves the fixed branding intact. 4. The complete HTML is submitted to the user's WeChat draft account. 5. If the user publishes the draft without identifying the injected footer, the third-party branding appears under the user's account. ### Impact Assessment The behavior can cause unauthorized attribution, reputatio ...[truncated 301 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/publish.py:108
Finding: WeChat AppSecret and Access Tokens Are Stored in Plaintext Files
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: docs/user_guide.md:218
Finding: Documentation Encourages Passing the AppSecret as a Command-Line Argument
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: docs/user_guide.md:24
Finding: Unpinned Packages Are Installed Globally and Sometimes with Root Privileges
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (23)

Tainted flow: 'params' from os.environ.get (line 147, credential/environment) → requests.get (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/publish.py (reported line 160)May include surrounding context.
python
for i in range(1, retry_count + 1): try: self.logger.info(f"获取 Token（尝试 {i}/{retry_count}）") response = requests.get(token_url, params=params, timeout=30) response.raise_for_status() result = response.json()

Tainted flow: 'params' from os.environ.get (line 147, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/publish.py (reported line 306)May include surrounding context.
python
for i in range(1, retry_count + 1): try: self.logger.info(f"创建草稿（尝试 {i}/{retry_count}）") response = requests.post( draft_url, params=params, json=data,

Chaining Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: Chaining curl directly into sudo bash creates a one-step path from network content to privileged code execution. In a skill installation guide, this is especially dangerous because users are primed to trust and execute setup commands without inspection, amplifying supply-chain and MITM risk.
Content: Scanner excerpt · docs/user_guide.md (reported line 86)May include surrounding context.
bash
# 1. 打开终端 # 2. 安装 Node.js（如未安装） curl -fsSL https://deb.nodesource.com/setup_16.x | sudo -E bash - sudo apt-get install -y nodejs # 3. 安装 OpenClaw

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 95% confidence
Finding: The use of sudo -E preserves the caller's environment while invoking a root shell on a remotely fetched script. Preserving environment variables can unintentionally influence privileged execution and broadens the attack surface beyond the already dangerous curl-to-bash pattern.
Content: Scanner excerpt · docs/user_guide.md (reported line 86)May include surrounding context.
bash
# 1. 打开终端 # 2. 安装 Node.js（如未安装） curl -fsSL https://deb.nodesource.com/setup_16.x | sudo -E bash - sudo apt-get install -y nodejs # 3. 安装 OpenClaw

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 95% confidence
Finding: The use of sudo -E preserves the caller's environment while invoking a root shell on a remotely fetched script. Preserving environment variables can unintentionally influence privileged execution and broadens the attack surface beyond the already dangerous curl-to-bash pattern.
Content: Scanner excerpt · docs/user_guide.md (reported line 86)May include surrounding context.
bash
# 1. 打开终端 # 2. 安装 Node.js（如未安装） curl -fsSL https://deb.nodesource.com/setup_16.x | sudo -E bash - sudo apt-get install -y nodejs # 3. 安装 OpenClaw

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · docs/user_guide.md (reported line 87)May include surrounding context.
md
# 1. 打开终端 # 2. 安装 Node.js（如未安装） curl -fsSL https://deb.nodesource.com/setup_16.x | sudo -E bash - sudo apt-get install -y nodejs # 3. 安装 OpenClaw sudo npm install -g openclaw

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · docs/user_guide.md (reported line 90)May include surrounding context.
md
# 1. 打开终端 # 2. 安装 Node.js（如未安装） curl -fsSL https://deb.nodesource.com/setup_16.x | sudo -E bash - sudo apt-get install -y nodejs # 3. 安装 OpenClaw sudo npm install -g openclaw

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The guide instructs users to pass the WeChat AppSecret directly as a command-line argument. Secrets provided this way can be exposed through shell history, terminal logging, CI logs, and process listings visible to other local users, creating a realistic credential leakage path.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manual shows a full AppSecret embedded in a plaintext configuration example and gives only minimal permission guidance later in the FAQ. This normalizes storing sensitive credentials in cleartext files without adequate storage warnings, increasing the chance of accidental disclosure via backups, screenshots, source control, or weak file permissions.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · docs/user_guide.md (reported line 436)May include surrounding context.
npm install -g openclaw

解决方案 2：使用 sudo（macOS/Linux）

sudo npm install -g openclaw

text
**Q2: openclaw 命令找不到？**

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · docs/user_guide.md (reported line 452)May include surrounding context.
bash
# 检查配置文件权限 # macOS/Linux: chmod 600 ~/.agents/skills/wechat-publisher/config/config.json # Windows: 以管理员身份运行配置命令

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: 文件头部说明、类与日志文案均以中文固定呈现，未见用户可选择语言/区域的机制，也没有声明该技能仅面向特定中文环境。按照语言/locale 政策，强制单一语言而无用户选择或合理限定，属于自然语言层面的策略问题。
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/publish.py (reported line 146)May include surrounding context.
python
# 获取新 Token app_secret = self._get_app_secret() token_url = "https://api.weixin.qq.com/cgi-bin/token" params = { "grant_type": "client_credential", "appid": self.config["app_id"],

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/publish.py (reported line 283)May include surrounding context.
python
# 获取新 Token app_secret = self._get_app_secret() token_url = "https://api.weixin.qq.com/cgi-bin/token" params = { "grant_type": "client_credential", "appid": self.config["app_id"],

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script claims to automatically publish AI news, but the content is hardcoded placeholder text rather than sourced current news. In a publishing automation context, this mismatch can cause unauthorized or misleading publication of fabricated/stale content, creating integrity and reputational risk for the account owner.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script includes trial enforcement, local license checks, usage tracking, and purchase upsell behavior unrelated to the core publishing function. In an agent skill context, this is risky because it introduces hidden business logic, local state manipulation, and user-pressure behavior that can interfere with automation and may not be expected by operators reviewing a publishing tool.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The script performs a remote draft-creation action against a live WeChat account without an explicit confirmation prompt, dry-run mode, or strong risk notice at the point of execution. In an agent skill setting, this increases the chance of unintended external publication actions when run automatically or by a user who misunderstands the effect.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/publish.py (reported line 306)May include surrounding context.
python
for i in range(1, retry_count + 1): try: self.logger.info(f"创建草稿（尝试 {i}/{retry_count}）") response = requests.post( draft_url, params=params, json=data,

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly automates publishing to a WeChat public account draft box and requires app_id and app_secret, but it does not warn users that content and credentials will be used to write data to an external third-party platform. This can cause users to disclose sensitive credentials or trigger unintended publication workflows without informed consent, especially because the skill markets convenience and automation rather than data-handling risks.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The config hard-codes "Asia/Shanghai" as the timezone, which is a locale-specific setting. Under the policy, forcing a specific locale without user opt-in or clear region-specific justification is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The natural-language content presents the entire skill guide exclusively in Chinese and does not indicate that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking audience for a documented reason. Under the stated policy, forcing a specific language without opt-in can be a locale-policy issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The documentation sets timezone to Asia/Shanghai by default without clearly documenting that this is a China-specific locale assumption or emphasizing user choice. In an automation skill that schedules external publication, an implicit timezone default can cause posts to be published at unintended times, which may lead to operational mistakes or accidental release of content.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This HTML template hard-codes Chinese headings and footer text alongside an English subtitle, which imposes a specific language/locale presentation on generated output. Under the policy, language constraints should either be user-selectable or clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

T01 · Skill Instruction Hijacking

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

SkillSpector

Tainted flow: 'params' from os.environ.get (line 147, credential/environment) → requests.get (network output)

Tainted flow: 'params' from os.environ.get (line 147, credential/environment) → requests.post (network output)

Chaining Abuse

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Missing User Warnings

Missing User Warnings

Sudo/Root Execution

解决方案 2：使用 sudo（macOS/Linux）

Sudo/Root Execution

Natural-Language Policy Violations

External Transmission

External Transmission

Intent-Code Divergence

Context-Inappropriate Capability

Missing User Warnings

External Transmission

Missing User Warnings

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations