Security audit

Wechat Publisher Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill’s core WeChat draft-publishing behavior is coherent, but its documentation and code handle credentials and privileged installation in ways users should review carefully before installing.

Install only if you are comfortable giving the skill WeChat public-account API credentials and allowing it to create drafts, including on a schedule. Prefer secure secret storage over command-line, hardcoded, or plaintext examples; protect any config and token-cache files with owner-only permissions; avoid the documented curl-to-sudo and sudo npm install paths unless you independently trust and verify them; test on a non-production account before enabling daily automation.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

Location: docs/user_guide.md:101
Finding: Remote Installation Script Executed Directly with Root Privileges
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/publish.py:167
Finding: WeChat Access Token Cached in a Plaintext File Without Enforced Permissions
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: docs/user_guide.md:105
Finding: Unpinned Global Package Installation with Elevated Privileges
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (40)

Tainted flow: 'params' from os.environ.get (line 147, credential/environment) → requests.get (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/publish.py (reported line 160)May include surrounding context.
python
for i in range(1, retry_count + 1): try: self.logger.info(f"获取 Token（尝试 {i}/{retry_count}）") response = requests.get(token_url, params=params, timeout=30) response.raise_for_status() result = response.json()

Tainted flow: 'params' from os.environ.get (line 147, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/publish.py (reported line 306)May include surrounding context.
python
for i in range(1, retry_count + 1): try: self.logger.info(f"创建草稿（尝试 {i}/{retry_count}）") response = requests.post( draft_url, params=params, json=data,

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The troubleshooting guide explicitly recommends hardcoding a live AppID and AppSecret into scripts and config files. This materially increases the chance of credential leakage through source control, local backups, screenshots, logs, or multi-user systems, and it normalizes insecure secret handling in operational guidance.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The document advises storing the AppSecret directly in script source and plaintext config without any warning about exposure risk. Even if meant as troubleshooting guidance, this encourages unsafe practices that can lead to account compromise if the secret is copied, shared, committed, or read by other local processes/users.
Content: No source excerpt is available for this finding.

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · docs/troubleshooting.md (reported line 313)May include surrounding context.
bash
# Windows 防火墙 netsh advfirewall firewall show rule name=all | findstr "WeChat"

Chaining Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: This is a classic dangerous command chain: a network fetch piped directly into sudo bash. The chain removes opportunities for user inspection and combines remote content retrieval with immediate privileged execution, making compromise fast and severe.
Content: Scanner excerpt · docs/user_guide.md (reported line 101)May include surrounding context.
bash
# 1. 打开终端 # 2. 安装 Node.js（如未安装） curl -fsSL https://deb.nodesource.com/setup_16.x | sudo -E bash - sudo apt-get install -y nodejs # 3. 安装 OpenClaw

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Line L108 states '全部中文，无英文', which is a natural-language locale restriction that applies uniformly rather than as an optional preference. This matches the policy-violation category because it forces a specific language without documenting user choice or a justified regional constraint.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The guide includes a full AppSecret in configuration and status output examples, which normalizes exposing a credential in plaintext on screen and in documentation. Readers may reuse real secrets in similar contexts, leak them through shell history, screenshots, logs, or copied support requests, enabling unauthorized access to the WeChat account API.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The guide instructs users to schedule daily publishing at 06:00 without clearly warning that this enables unattended, recurring remote actions against their WeChat account. Users may not understand that once enabled, the skill will continue operating automatically and could post unwanted or incorrect content if misconfigured or compromised.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The installation guide presents --test as a harmless test step, but the sample output shows it creates a real remote draft in the user's WeChat account. Without a prominent warning, users may trigger external side effects on production accounts unintentionally, potentially publishing or staging content they did not intend to create.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The file is a markdown document, so SQP-3 applies. The title and content prescribe a WeChat public-account publishing process entirely in Chinese and fix the locale/timezone to East Asia context, but do not indicate that this language/locale is optional or user-selected; this can violate the policy against forcing a specific language or locale without opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The lines '全部中文，无英文' and '自动翻译英文新闻' impose a fixed language policy on all users. Under the policy rules, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly justified, which this document does not provide.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The diagnostic script reads the AppSecret from disk and prints part of it to the console, confirming both the location and value prefix of a sensitive credential. Partial disclosure still leaks secret material and can expose credentials via terminal history, logs, screenshots, or remote support sessions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The guide describes fully automatic daily publishing to a WeChat draft box on the user's behalf, but does not prominently warn users that the skill will perform account actions automatically once configured. In a skill that operates with app_secret and scheduled execution, lack of explicit consent/confirmation messaging increases the risk of unintended postings, reputational harm, and surprising account activity.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The documentation states that all news content must be in Chinese and that English news is automatically translated. This is a language-policy constraint presented as mandatory behavior, with no indication that users can choose another language or explicitly opt into this locale restriction.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 88% confidence
Finding: The command curl -fsSL https://deb.nodesource.com/setup_16.x | sudo -E bash - pipes a remote script directly into a root shell. This is dangerous because any compromise of the remote endpoint, TLS interception, or script change results in immediate arbitrary code execution with elevated privileges.
Content: Scanner excerpt · docs/user_guide.md (reported line 101)May include surrounding context.
bash
# 1. 打开终端 # 2. 安装 Node.js（如未安装） curl -fsSL https://deb.nodesource.com/setup_16.x | sudo -E bash - sudo apt-get install -y nodejs # 3. 安装 OpenClaw

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 88% confidence
Finding: The command curl -fsSL https://deb.nodesource.com/setup_16.x | sudo -E bash - pipes a remote script directly into a root shell. This is dangerous because any compromise of the remote endpoint, TLS interception, or script change results in immediate arbitrary code execution with elevated privileges.
Content: Scanner excerpt · docs/user_guide.md (reported line 101)May include surrounding context.
bash
# 1. 打开终端 # 2. 安装 Node.js（如未安装） curl -fsSL https://deb.nodesource.com/setup_16.x | sudo -E bash - sudo apt-get install -y nodejs # 3. 安装 OpenClaw

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · docs/user_guide.md (reported line 102)May include surrounding context.
md
# 1. 打开终端 # 2. 安装 Node.js（如未安装） curl -fsSL https://deb.nodesource.com/setup_16.x | sudo -E bash - sudo apt-get install -y nodejs # 3. 安装 OpenClaw sudo npm install -g openclaw

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 75% confidence
Finding: The guide recommends sudo npm install -g openclaw, which installs a package globally with root privileges. If the package or its dependency chain is compromised, arbitrary code would execute as root during installation, amplifying supply-chain risk.
Content: Scanner excerpt · docs/user_guide.md (reported line 105)May include surrounding context.
md
sudo apt-get install -y nodejs # 3. 安装 OpenClaw sudo npm install -g openclaw # 4. 验证安装 openclaw --version

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The guide instructs users to place the WeChat AppSecret directly on the command line and in a plaintext configuration file. This exposes a long-lived credential to shell history, process listings, backups, and accidental disclosure, which could allow unauthorized access to the WeChat public account API.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: Passing AppSecret as a CLI argument can leak it through shell history, terminal logging, process monitors, or multi-user system process listings. Because this secret grants API access to the user's WeChat account integration, disclosure can lead to unauthorized publishing or account misuse.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manual directs users to save AppSecret in a plaintext JSON file without an upfront security warning or default protection mechanism. Plaintext credential storage increases the chance of theft via local compromise, backups, sync tools, malware, or accidental sharing of the skill directory.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The document is for a WeChat public account publishing skill, but a substantial section describes buying, activating, and inspecting a commercial license, including payment flow and activation codes. For an unknown-purpose skill, monetization and license-management capabilities are not inherently justified by the core operational purpose of publishing content.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 72% confidence
Finding: Recommending sudo npm install -g openclaw as a troubleshooting step normalizes rerunning third-party package installation with elevated privileges. This increases the impact of a compromised package or malicious dependency and can lead to full system compromise.
Content: Scanner excerpt · docs/user_guide.md (reported line 451)May include surrounding context.
npm install -g openclaw

解决方案 2：使用 sudo（macOS/Linux）

sudo npm install -g openclaw

text
**Q2: openclaw 命令找不到？**

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · docs/user_guide.md (reported line 467)May include surrounding context.
bash
# 检查配置文件权限 # macOS/Linux: chmod 600 ~/.agents/skills/wechat-publisher/config/config.json # Windows: 以管理员身份运行配置命令

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

SkillSpector

Tainted flow: 'params' from os.environ.get (line 147, credential/environment) → requests.get (network output)

Tainted flow: 'params' from os.environ.get (line 147, credential/environment) → requests.post (network output)

Intent-Code Divergence

Missing User Warnings

Direct Prompt Extraction

Chaining Abuse

Natural-Language Policy Violations

Missing User Warnings

Missing User Warnings

Missing User Warnings

Natural-Language Policy Violations

Natural-Language Policy Violations

Missing User Warnings

Missing User Warnings

Natural-Language Policy Violations

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Context-Inappropriate Capability

Missing User Warnings

Missing User Warnings

Context-Inappropriate Capability

Sudo/Root Execution

解决方案 2：使用 sudo（macOS/Linux）

Sudo/Root Execution

Static analysis