ClawHub
Back to skill

Security audit

Wechat Publisher Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it claims, but it gives unsafe install and credential-handling guidance and hardcodes third-party attribution into drafts created in the user's WeChat account.

Review this skill before installing. Use a test WeChat account first, replace or remove hardcoded author/footer branding, avoid the sudo curl pipeline, do not put AppSecret values in command lines or documentation, and store credentials/tokens with owner-only permissions or a secret manager.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)

T03 · Remote Payload Retrieval and Execution

Error
Location
docs/user_guide.md:101
Finding

Privileged execution of an unverified remote installation script

Content
View full analysis
Remediation
View remediation

T01 · Skill Instruction Hijacking

Warning
Location
templates/v5-simple.html:62
Finding

Hardcoded third-party attribution and branding injected into user publications

Content
View full analysis

Data sources

TechCrunch AI · MIT Technology Review · The Verge

心识孤独的猎手

AI industry news · Updated daily

``` ```python data = { "articles": [ { "title": title, "author": "小蛋蛋", "digest": "15 条 AI 新闻", "content": content, "thumb_media_id": self.config.get("cover_media_id", ""), "show_cover_pic": 1 } ] } ``` ### Technical Analysis The Skill unconditionally attributes articles to identities controlled by the Skill publisher. The API payload fixes the article author, while the HTML template inserts another fixed identity into the visible footer. Neither value is sourced from user configuration, and the default behavior does not omit branding. Consequently, invoking the Skill modifies content published under the user's WeChat account to advertise or attribute it to an unrelated third party. This behavior is not required to create a WeChat draft and exceeds the minimum output modification needed for the declared publishing functionality. ### Attack Path 1. A user supplies their WeChat AppID and AppSecret. 2. The Skill constructs article content using the bundled fixed template. 3. The template inserts the Skill publisher's identity into the visible footer. 4. The publishing script sets another hardcoded identity as the article author. 5. The content is uploaded to the user's WeChat dr ...[truncated 506 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/publish.py:169
Finding

WeChat access tokens and application secrets are stored or exposed insecurely

Content
View full analysis
Remediation
View remediation
`. ]]>

T08 · Insecure Dependencies

Warning
Location
docs/user_guide.md:88
Finding

Unpinned dependencies are installed globally or without integrity verification

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
skill.md:138
Finding

Public network metadata is disclosed through an unencrypted third-party IP lookup

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (37)

Tainted flow: 'params' from os.environ.get (line 147, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/publish.py (reported line 160)May include surrounding context.

python
for i in range(1, retry_count + 1):
            try:
                self.logger.info(f"获取 Token（尝试 {i}/{retry_count}）")
                response = requests.get(token_url, params=params, timeout=30)
                response.raise_for_status()
                result = response.json()

Tainted flow: 'params' from os.environ.get (line 147, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/publish.py (reported line 306)May include surrounding context.

python
for i in range(1, retry_count + 1):
            try:
                self.logger.info(f"创建草稿（尝试 {i}/{retry_count}）")
                response = requests.post(
                    draft_url,
                    params=params,
                    json=data,

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The troubleshooting guide explicitly recommends storing a live AppID and AppSecret directly in PowerShell and JSON examples, and even marks hardcoding as a recommended solution. This creates a strong risk of credential exposure through source control, local file disclosure, logs, screenshots, or reuse of the example secret, enabling unauthorized access to the WeChat API account.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

This section instructs users to hardcode the AppSecret in scripts and config files without any warning about the sensitivity of the credential or the exposure risks. In the context of an automation skill, this is especially dangerous because such files are likely to be copied, backed up, logged, or stored in agent workspaces where other components or users may access them.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · docs/troubleshooting.md (reported line 313)May include surrounding context.

bash
# Windows 防火墙
netsh advfirewall firewall show rule name=all | findstr "WeChat"

Chaining Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

The command pipes content fetched from the network directly into a privileged shell, creating a classic chaining-abuse pattern with immediate root-code-execution potential. In a user guide, this is especially dangerous because it encourages copy-paste execution by non-expert users, magnifying the impact of any compromise of the remote script source or delivery path.

Content

Scanner excerpt · docs/user_guide.md (reported line 101)May include surrounding context.

bash
# 1. 打开终端
# 2. 安装 Node.js（如未安装）
curl -fsSL https://deb.nodesource.com/setup_16.x | sudo -E bash -
sudo apt-get install -y nodejs

# 3. 安装 OpenClaw

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The setting forces the timezone to "Asia/Shanghai", which implies a specific locale preference without any indication that users can opt in or override it. This can violate language/locale policy expectations when a skill imposes a region-specific default without documented justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

Line L108 states '全部中文，无英文', which imposes a fixed language requirement in the skill documentation. This is a natural-language locale policy constraint with no user opt-in or justification that the skill is region-specific.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The installation guide includes a realistic-looking full AppSecret in interactive configuration examples, even though the document later states AppSecret is sensitive. Users commonly copy documentation patterns into screenshots, shell history, tickets, or shared notes, so normalizing display of full secrets increases the risk of credential disclosure and misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The guide exposes a full AppSecret in setup examples without warning users not to reveal it in terminals, support chats, screenshots, or command history. Because this document is specifically about configuring a live external publishing integration, mishandling the secret could allow unauthorized API access to the associated WeChat account.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The guide instructs users to schedule automatic publishing and run a test publish against a real WeChat account, but it does not clearly warn that these actions interact with an external platform and may create live drafts or cause unintended content publication workflows. In a publishing skill, this omission can lead to accidental outbound actions, reputational harm, and content being sent to the wrong account or at the wrong time.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The --show configuration example prints the full AppSecret, which teaches users that revealing the secret in terminal output is acceptable. Terminal output is often captured in shell history, CI logs, remote support sessions, and screenshots, so exposing a credential in this way can lead to account compromise against the connected WeChat public account.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The file title and the entire publishing specification are written as a required WeChat public-account workflow in Chinese, indicating the skill is constrained to a specific language/locale. Under the policy, language or locale restrictions should either be user-selectable or explicitly justified as region-specific; this document does not provide that justification or opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The document states '全部中文，无英文' and '自动翻译英文新闻', which imposes a fixed language policy on all users. This is a natural-language policy concern because it removes user language/locale choice and does not document any region-specific justification for the restriction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The entire skill documentation is presented only in Chinese, including operational instructions and support channels, with no indication that users may choose another language. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This markdown file states that after setup the skill will automatically collect news and publish to the draft box every day at 06:00. Because this behavior affects an external user account and creates content automatically, the documentation should explicitly warn users about the automated posting side effect before enabling scheduling.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation states that all news content must be in Chinese and that English news will be automatically translated. This is a language-policy constraint presented as mandatory behavior, but the file does not mention user opt-in, configurability, or a clear region-specific justification.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
89% confidence
Finding

The specific use of 'sudo -E' is riskier than ordinary sudo because it preserves caller environment variables when invoking a privileged shell. That can allow unintended environment-influenced behavior in root-executed scripts and is unnecessary in generic installation documentation.

Content

Scanner excerpt · docs/user_guide.md (reported line 101)May include surrounding context.

bash
# 1. 打开终端
# 2. 安装 Node.js（如未安装）
curl -fsSL https://deb.nodesource.com/setup_16.x | sudo -E bash -
sudo apt-get install -y nodejs

# 3. 安装 OpenClaw

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
89% confidence
Finding

The specific use of 'sudo -E' is riskier than ordinary sudo because it preserves caller environment variables when invoking a privileged shell. That can allow unintended environment-influenced behavior in root-executed scripts and is unnecessary in generic installation documentation.

Content

Scanner excerpt · docs/user_guide.md (reported line 101)May include surrounding context.

bash
# 1. 打开终端
# 2. 安装 Node.js（如未安装）
curl -fsSL https://deb.nodesource.com/setup_16.x | sudo -E bash -
sudo apt-get install -y nodejs

# 3. 安装 OpenClaw

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · docs/user_guide.md (reported line 102)May include surrounding context.

md
# 1. 打开终端
# 2. 安装 Node.js（如未安装）
curl -fsSL https://deb.nodesource.com/setup_16.x | sudo -E bash -
sudo apt-get install -y nodejs

# 3. 安装 OpenClaw
sudo npm install -g openclaw

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Instructing users to run 'sudo npm install -g openclaw' causes third-party package installation scripts to execute with root privileges. If the package or its dependency chain is malicious or compromised, the result can be full system compromise.

Content

Scanner excerpt · docs/user_guide.md (reported line 105)May include surrounding context.

md
sudo apt-get install -y nodejs

# 3. 安装 OpenClaw
sudo npm install -g openclaw

# 4. 验证安装
openclaw --version

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The guide instructs users to pass the AppSecret directly on the command line, which commonly exposes secrets through shell history, process listings, audit logs, and remote session transcripts. Because AppSecret is a credential for the WeChat public account API, leakage could allow unauthorized access or publishing actions depending on downstream permissions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manual tells users to store AppSecret in plaintext in a JSON config file, creating a secret-at-rest exposure if the file is read by other local users, malware, backups, sync tools, or source-control accidents. Although later it mentions restrictive permissions on Unix, the primary workflow still normalizes plaintext secret storage without strong warnings or a safer default.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
81% confidence
Finding

The troubleshooting advice again recommends 'sudo npm install -g openclaw', repeating the risk of executing npm lifecycle scripts and dependency code as root. This expands the chance that users follow an unsafe privileged install path during error recovery when they may be less cautious.

Content

Scanner excerpt · docs/user_guide.md (reported line 451)May include surrounding context.

npm install -g openclaw

解决方案 2：使用 sudo（macOS/Linux）

sudo npm install -g openclaw

text

**Q2: openclaw 命令找不到？**

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · docs/user_guide.md (reported line 467)May include surrounding context.

bash
# 检查配置文件权限
# macOS/Linux:
chmod 600 ~/.agents/skills/wechat-publisher/config/config.json

# Windows: 以管理员身份运行配置命令

Static analysis

No suspicious patterns detected.