ClawHub
Back to skill

Security audit

Wechat Publisher Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent WeChat publishing purpose, but it asks users to handle powerful publishing credentials in unsafe ways and includes high-impact install and content-branding concerns.

Review before installing. Use this only with a WeChat account where you accept automated draft creation, replace hard-coded author/footer branding, avoid the curl-to-sudo install path, do not put AppSecret values on the command line or in shared files, restrict permissions on any config/cache files, and rotate credentials if you have already copied the example patterns.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)

T03 · Remote Payload Retrieval and Execution

Error
Location
docs/user_guide.md:101
Finding

Unverified Remote Script Executed with Root Privileges

Content
View full analysis

Vulnerability Details

File Location: docs/user_guide.md:101
Vulnerability Type: Remote payload retrieval and privileged execution
Risk Level: Critical

Vulnerable Code

bash
curl -fsSL https://deb.nodesource.com/setup_16.x | sudo -E bash -

Technical Analysis

The installation guide directs users to retrieve a mutable shell script from an external server and pipe it directly into a root-privileged shell. The downloaded content is not pinned to a version, saved for inspection, checked against a cryptographic digest, or verified using a trusted signature.

Consequently, the code executed on a user's machine can differ from the code available when the Skill was audited. The use of sudo gives the retrieved payload unrestricted system privileges, substantially exceeding the permissions needed merely to provide installation guidance.

Although HTTPS protects the connection in transit under normal conditions, it does not mitigate compromise of the remote hosting account, upstream build system, certificate trust chain, or distributed script itself.

Attack Path

  1. An attacker compromises the remote script, its hosting infrastructure, or a trusted distribution account.
  2. The attacker adds arbitrary shell commands to the remotely hosted setup script.
  3. A user follows the Skill's recommended installation procedure.
  4. curl retrieves the attacker-controlled content without pinning or independent verification.
  5. The pipe sends that content directly to sudo bash.
  6. The attacker's commands execute as root before the user can inspect them.

Impact Assessment

Successful exploitation provides arbitrary root-level code execution. An attacker could read or modify any locally accessible file, extract WeChat and other credentials, install persistent services, alter system binaries, add users or SSH keys, disable security controls, or pivot to other systems reachable from the host.

The impac ...[truncated 96 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the curl | sudo bash installation pattern.
  • Prefer signed operating-system packages installed through a trusted package repository.
  • If a standalone installer is unavoidable, download a version-pinned artifact to disk before execution.
  • Publish and verify a cryptographic signature using a key distributed through an independent trusted channel.
  • At minimum, verify a version-specific SHA-256 digest before execution.
  • Let users inspect the downloaded script before running it.
  • Execute installation steps without root privileges wherever possible, elevating only narrowly scoped package-management operations.
  • Document the exact external components installed and the permissions each step requires.

T01 · Skill Instruction Hijacking

Error
Location
templates/v5-simple.html:64
Finding

Fixed Template Injects Third-Party Branding into User Publications

Content
View full analysis

Vulnerability Details

File Location: templates/v5-simple.html:64-67; related hard-coded author at scripts/publish.py:289-292
Vulnerability Type: Stable promotional output and authorship injection
Risk Level: High

Vulnerable Code

html
<p style="font-size:12px;color:#999999;margin:0 0 6px;">Data source</p>
<p style="font-size:11px;color:#888888;margin:0 0 16px;">TechCrunch AI · MIT Technology Review · The Verge</p>
<p style="font-size:13px;font-weight:600;color:#1a1a1a;margin:0 0 4px;">心识孤独的猎手</p>
<p style="font-size:11px;color:#999999;margin:0;">AI 行业前沿资讯 · 每日更新</p>

The associated draft payload also fixes the author instead of obtaining it from user configuration:

python
data = {
    "articles": [
        {
            "title": title,
            "author": "小蛋蛋",
            "digest": "15 条 AI 新闻",
            "content": content,

Technical Analysis

The bundled template inserts the Skill publisher's identity into content uploaded through the user's WeChat account. The draft payload independently sets a hard-coded author. Neither identity is derived from the user's account, configuration, or explicit approval.

The Skill documentation describes the template as fixed and prescribes additional follow/QR-code content. This turns the publishing workflow into a stable mechanism for altering user-facing output to promote or attribute content to a third party.

This behavior is not required to create a WeChat draft. Author, footer, branding, and QR-code content can all be supplied by the account owner. The hard-coded values therefore exceed the minimum behavior necessary for the declared publishing functionality.

Attack Path

  1. The user configures the Skill with credentials for a WeChat public account.
  2. The Skill loads the bundled fixed template.
  3. The template inserts the Skill author's branding into the article footer.
  4. The Python code assigns a separate h ...[truncated 695 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove all developer-specific names, promotional text, follow prompts, and QR codes from the default template.
  • Replace the hard-coded author value with a user-controlled configuration field.
  • Make footer branding and QR-code insertion disabled by default and explicitly opt-in.
  • Show a complete preview of the exact title, author, digest, HTML, media, and links before upload.
  • Require explicit user confirmation before sending branded content to WeChat.
  • Validate that templates installed or selected by the user do not silently introduce undeclared promotional material.
  • Clearly distinguish optional attribution from content required for technical operation.

T09 · Insecure Skill Coding Practices

Error
Location
scripts/publish.py:169
Finding

WeChat Access Token Cached in Plaintext Without Restrictive Permissions

Content
View full analysis

Vulnerability Details

File Location: scripts/publish.py:169-176
Vulnerability Type: Plaintext storage of sensitive authentication material
Risk Level: High

Vulnerable Code

python
# Cache Token
cache_data = {
    "token": token,
    "time": datetime.now().isoformat(),
    "expires_in": result.get("expires_in", 7200)
}
with open(self.token_cache_path, "w", encoding="utf-8") as f:
    json.dump(cache_data, f, indent=2, ensure_ascii=False)

Related documentation also recommends supplying and storing the AppSecret directly:

bash
openclaw skill config wechat-publisher \
  --app-id wxebff9eadface1489 \
  --app-secret 44c10204ceb1bfb3f7ac096754976454
json
{
  "app_id": "wxebff9eadface1489",
  "app_secret": "44c10204ceb1bfb3f7ac096754976454"
}

Technical Analysis

The access token is serialized directly into memory/token-cache.json. The file is created using the process's default permissions, with no explicit 0600 mode, ownership validation, encryption, or credential-store integration.

A WeChat access token is bearer authentication material. Any process or user that can read it may invoke permitted WeChat APIs until it expires. The documentation compounds this exposure by recommending command-line AppSecret arguments, which may be retained in shell history or exposed through process inspection, and plaintext JSON configuration.

The network transmission itself is directed to the official https://api.weixin.qq.com endpoint and is necessary for token acquisition and draft creation. The security issue is the local handling and exposure of the secret and resulting token.

Attack Path

  1. The user supplies a WeChat AppSecret and runs the publisher.
  2. The Skill sends the AppID and AppSecret to the official WeChat token endpoint.
  3. WeChat returns an access token.
  4. The Skill writes that token as plaintext JSON using default file permissions.

...[truncated 939 chars]

Remediation
View remediation

Remediation Suggestions

  • Store AppSecret values in an operating-system credential manager or a dedicated secrets service.
  • Do not accept secrets as command-line arguments.
  • Use a non-echoing interactive prompt or securely injected environment variable when a credential manager is unavailable.
  • Avoid persisting access tokens unless caching is operationally necessary.
  • If caching is required, create the file atomically with mode 0600 and verify that its owner is the current user.
  • Refuse to use cache or configuration files that are group- or world-readable.
  • Keep secret-bearing files outside directories likely to be synchronized, archived, or committed.
  • Provide token-cache deletion and AppSecret rotation procedures.
  • Add ignore rules preventing configuration, token, license, usage, and memory files from entering source control.
  • Never include credential values in exceptions, status files, or logs.

T09 · Insecure Skill Coding Practices

Warning
Location
skill.md:138
Finding

Public-IP Discovery Uses an Unencrypted Third-Party Endpoint

Content
View full analysis

Vulnerability Details

File Location: skill.md:138
Vulnerability Type: Insecure plaintext network request used for access-control configuration
Risk Level: Medium

Vulnerable Code

bash
curl http://ip-api.com/json/

Technical Analysis

The Skill instructs users to obtain their public IP address from a third-party service over plaintext HTTP. The request necessarily discloses the user's public source IP to that service, while the lack of transport encryption allows an on-path attacker to observe or modify the response.

The returned value is intended to be added to the WeChat API IP allowlist. This gives the unverified HTTP response a security-sensitive role in access-control configuration.

Public-IP discovery can be useful for WeChat allowlisting, but it should use authenticated HTTPS and should clearly disclose the external service involved.

Attack Path

  1. The user runs the documented curl command.
  2. The request travels to the third-party endpoint over unencrypted HTTP.
  3. A network attacker intercepts and modifies the JSON response.
  4. The user trusts the returned address and adds it to the WeChat IP allowlist.
  5. The legitimate publisher may remain blocked, or an attacker-controlled address may be incorrectly authorized if accepted by the user.

Impact Assessment

The direct privacy impact is disclosure of the user's public IP address to a third party. Integrity compromise can lead to denial of service through incorrect allowlist configuration and may result in unintended network authorization if a manipulated address is added.

This issue alone does not expose the AppSecret or grant local system privileges. Its security relevance arises from using unauthenticated network data to guide an account access-control decision.

Remediation
View remediation

Remediation Suggestions

  • Replace the HTTP URL with an HTTPS endpoint.
  • Prefer an IP-discovery method operated by the platform provider or selected by the user.
  • Clearly disclose that the command contacts a third party and reveals the user's public IP.
  • Ask users to confirm the result through a second trusted source before changing an allowlist.
  • Document how NAT, VPNs, proxies, and dynamically assigned addresses affect the result.
  • Do not automatically modify an allowlist based solely on an unauthenticated external response.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (41)

Tainted flow: 'params' from os.environ.get (line 147, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/publish.py (reported line 160)May include surrounding context.

python
for i in range(1, retry_count + 1):
            try:
                self.logger.info(f"获取 Token（尝试 {i}/{retry_count}）")
                response = requests.get(token_url, params=params, timeout=30)
                response.raise_for_status()
                result = response.json()

Tainted flow: 'params' from os.environ.get (line 147, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/publish.py (reported line 306)May include surrounding context.

python
for i in range(1, retry_count + 1):
            try:
                self.logger.info(f"创建草稿（尝试 {i}/{retry_count}）")
                response = requests.post(
                    draft_url,
                    params=params,
                    json=data,

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The troubleshooting guide explicitly recommends hardcoding the WeChat AppSecret directly into a script, which materially increases the chance of credential exposure through source control, local file disclosure, backups, logs, screenshots, and shared troubleshooting artifacts. In the context of a publishing skill that uses privileged API credentials, compromise of the AppSecret can enable unauthorized access to the associated WeChat account and abuse of its publishing capabilities.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

This section recommends placing the AppSecret both in script source and in a plain configuration file without any prominent warning about credential handling, encryption, or access restrictions. That normalizes insecure secret storage and makes accidental leakage likely, especially because this skill also includes support and diagnostic workflows that encourage inspecting and sharing configuration state.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · docs/troubleshooting.md (reported line 313)May include surrounding context.

bash
# Windows 防火墙
netsh advfirewall firewall show rule name=all | findstr "WeChat"

Chaining Abuse

High
Category
Tool Misuse
Confidence
96% confidence
Finding

The guide instructs users to pipe a remote curl response directly into sudo bash, which executes network-fetched code immediately with root privileges and no integrity verification. If the upstream server, mirror, DNS, TLS trust path, or network is compromised, an attacker gains full system compromise.

Content

Scanner excerpt · docs/user_guide.md (reported line 101)May include surrounding context.

bash
# 1. 打开终端
# 2. 安装 Node.js（如未安装）
curl -fsSL https://deb.nodesource.com/setup_16.x | sudo -E bash -
sudo apt-get install -y nodejs

# 3. 安装 OpenClaw

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The document states that this is an official fixed template that all users must use, and later requires '全部中文，无英文'. This imposes a specific language/locale on all users without offering user choice or documenting a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The content requirement says each item must be at least 80 characters and '全部中文，无英文', which is a natural-language policy constraint. Because the file does not offer a language choice or explain a narrow justified locale scope, this is a policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The configuration prompt example shows a complete AppSecret value during setup without warning about terminal visibility or recording risk. This encourages unsafe operator behavior and increases the chance real secrets will be exposed through shell history, screen sharing, logs, or copied setup transcripts.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The installation guide includes a full-looking AppSecret example while simultaneously describing AppSecret as sensitive information. Even if the value is illustrative, publishing secrets in examples normalizes unsafe handling and can lead users to paste real credentials into terminals, docs, screenshots, or support channels.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The --show configuration output example reveals the full app_secret, implying the tool may display secrets in plaintext or that doing so is acceptable. In a skill managing live publishing credentials, exposing secrets in routine status commands materially raises the risk of credential theft from terminals, logs, or shared debugging output.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
82% confidence
Finding

The document prescribes a hardcoded schedule of '每天早上 6:00（东八区）', which imposes a specific locale/timezone behavior in natural-language instructions. Under the policy, fixed locale constraints should either be optional for the user or clearly justified as region-specific; this file does not provide that justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The template explicitly requires all output to be in Chinese and automatic translation of English news, without indicating any user-controlled language preference or opt-out. In a publishing skill, this can cause unsafe or non-compliant behavior by overriding user intent, misrepresenting source material through forced translation, and reducing accessibility for users who need another language.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The support instructions ask users to provide diagnostic script output, and that script prints the AppID and a partial AppSecret from the config file. Even partial credential disclosure and surrounding system details can aid credential harvesting, account targeting, or social engineering, and users may also send screenshots containing more than intended.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The guide instructs users to supply a WeChat app_secret but provides no secure-handling guidance such as avoiding plaintext storage, logs, screenshots, or source-controlled config files. Because app_secret is a credential for a publishing integration, poor secret hygiene can enable account takeover of the integration and unauthorized publication to the公众号.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The guide documents unattended daily publishing and writing result files, but it does not clearly warn users that the skill will continuously perform outbound actions and persist local data on a schedule. In an automation skill that posts to an official WeChat account, missing transparency increases the risk of unintended publication, operational surprises, and unnoticed retention of content metadata on disk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The text requires that all news content be in Chinese and explicitly disallows English, while also mandating automatic translation of English news. SQP-3 covers language or locale policy violations across all file types; this is a forced language requirement without any opt-in mechanism or clear justification that the skill is only for a China-specific or Chinese-language-only use case.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · docs/user_guide.md (reported line 101)May include surrounding context.

bash
# 1. 打开终端
# 2. 安装 Node.js（如未安装）
curl -fsSL https://deb.nodesource.com/setup_16.x | sudo -E bash -
sudo apt-get install -y nodejs

# 3. 安装 OpenClaw

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · docs/user_guide.md (reported line 451)May include surrounding context.

bash
# 1. 打开终端
# 2. 安装 Node.js（如未安装）
curl -fsSL https://deb.nodesource.com/setup_16.x | sudo -E bash -
sudo apt-get install -y nodejs

# 3. 安装 OpenClaw

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · docs/user_guide.md (reported line 101)May include surrounding context.

bash
# 1. 打开终端
# 2. 安装 Node.js（如未安装）
curl -fsSL https://deb.nodesource.com/setup_16.x | sudo -E bash -
sudo apt-get install -y nodejs

# 3. 安装 OpenClaw

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · docs/user_guide.md (reported line 102)May include surrounding context.

md
# 1. 打开终端
# 2. 安装 Node.js（如未安装）
curl -fsSL https://deb.nodesource.com/setup_16.x | sudo -E bash -
sudo apt-get install -y nodejs

# 3. 安装 OpenClaw
sudo npm install -g openclaw

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · docs/user_guide.md (reported line 105)May include surrounding context.

md
# 1. 打开终端
# 2. 安装 Node.js（如未安装）
curl -fsSL https://deb.nodesource.com/setup_16.x | sudo -E bash -
sudo apt-get install -y nodejs

# 3. 安装 OpenClaw
sudo npm install -g openclaw

Ssd 3

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The documentation repeatedly shows sensitive AppSecret values in commands, config examples, and partially displayed output, normalizing unsafe secret-handling practices. In the context of a publishing skill that requires live API credentials, this increases the likelihood of real credential reuse, accidental disclosure, and account takeover of the connected WeChat public account.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The guide instructs users to pass the WeChat AppSecret directly as a command-line argument. Secrets supplied this way are commonly exposed via shell history, terminal logging, crash reports, and process listings visible to other local users or monitoring tools, creating avoidable credential leakage risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The documentation tells users to store AppSecret in plaintext in a config file and does not clearly frame it as a sensitive credential requiring protected storage. Plaintext secrets are vulnerable to accidental backup exposure, local compromise, repo check-in, and broad file-read access if permissions are misconfigured.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.