wechat-article-fetcher

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:07 PM UTC
• Version: 1.0.0

Overview

The skill has a coherent WeChat article-saving purpose, but it automatically starts a background web server that can expose the whole OpenClaw workspace and serves unsanitized remote content.

Review before installing. Use only on trusted WeChat article links, avoid running fetch.sh on shared or network-reachable machines, and prefer changing the server to bind to 127.0.0.1 and serve only a dedicated output directory. Generated HTML should be treated as untrusted web content because scripts or active markup from the source article may be preserved.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: fetch.py:133

Finding

Server-Side Request Forgery Through Article-Controlled Media URLs

Content

View full analysis

100: with open(local_path, 'wb') as f: f.write(img_response.content) ``` ```python video_pattern = r' 100: with open(local_cover, 'wb') as f: f.write(resp.content) ``` ### Technical Analysis Media URLs are extracted from remotely retrieved article HTML and passed directly to `requests.get`. The code does not validate: - The URL scheme. - The destination hostname. - Resolved IP addresses. - Loopback, private, link-local, multicast, or reserved address ranges. - Redirect destinations. ...[truncated 1752 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: fetch.py:125

Finding

Stored Cross-Site Scripting in Generated Article HTML

Content

View full analysis

\u003chtml lang="zh-CN"> \u003chead> \u003cmeta charset="UTF-8"\u003e \u003cmeta name="viewport" content="width=device-width, initial-scale=1.0"\u003e \u003ctitle\u003e{html.escape(title)}\u003c/title\u003e ``` ```python \u003cbody\u003e \u003cdiv class="container"> \u003ch1 style="font-size: 24px; margin-bottom: 20px;"\u003e{html.escape(title)}\u003c/h1\u003e \u003cdiv class="rich_media_content"\u003e {original_html} \u003c/div\u003e \u003c/div\u003e ``` ### Technical Analysis The article body is extracted from an untrusted remote response and inserted directly into a generated HTML document. Although the title is escaped, `original_html` is not sanitized. Consequently, active content contained in the article body can survive reconstruction, including: - Script elements. - Event-handler attributes such as `onerror` or `onclick`. - Dangerous `javascript:` URLs. - Active SVG content. - Iframes and other embedded resources. - Forms or deceptive user-interface elements. The generated document does not include a restrictive Content Security Policy. When a user opens the saved article through the local HTTP server, browser-executable content can run under that server's origin. ### Attack Path 1. An attacker publishes or compromises an article containing active HTML in the extracted `js_content` section. 2. A user supplies the article ...[truncated 1157 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: fetch.sh:19

Finding

Entire Workspace Exposed by a Persistent HTTP Server Bound to All Interfaces

Content

View full analysis

/dev/null 2>&1; then echo "" echo "启动HTTP服务器在端口 $PORT..." cd /root/.openclaw/workspace && python3 -m http.server $PORT > /dev/null 2>&1 & sleep 2 fi ``` ### Technical Analysis `python3 -m http.server` binds to all available interfaces by default when no bind address is supplied. The command serves `/root/.openclaw/workspace`, not a dedicated directory containing only the generated article. The standard Python HTTP server also provides directory listings when an index file is absent. No authentication or authorization layer is configured. The process is launched in the background and is not terminated when the Skill completes, extending the exposure beyond the immediate operation. The documentation describes the service as a local preview, but the implementation can make it reachable by other systems on the same network or any network permitted by host firewall rules. ### Attack Path 1. A user invokes `fetch.sh`. 2. If the selected port is not already in use, the script starts `python3 -m http.server` from the OpenClaw workspace. 3. The server listens on all interfaces and remains active in the background. 4. A network-adjacent or otherwise reachable attacker connects to the selected port. 5. The attacker requests the root path and obtains a directory listing. 6. The attacker enumerates and downloads generated articles, media, SSRF response files, or unrelated readable workspace files. ### Impact Assessment The server can expose every readable file beneath `/root/.openclaw/workspace` to unauthenticated network clients. Potentially exposed content includes: - Generated article HTML. - Downloaded article images and video covers. - Content obtained through SSRF. - Unrelated files stored in ...[truncated 329 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: README.md:43

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (19)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The stated purpose is article fetching and offline saving, but the skill also instructs starting a local HTTP server and serving files from the workspace. That mismatch is dangerous because users and policy engines may approve the skill for passive content retrieval while overlooking that it exposes local files over HTTP, potentially broadening access to unrelated workspace contents.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script changes into /root/.openclaw/workspace and serves that entire directory over HTTP, far beyond the stated need to view one fetched article. If the HTTP server is reachable from other users or systems, any file in that workspace may be browsed and downloaded, leading to unintended disclosure of source code, credentials, outputs, or other sensitive data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README advertises automatic network fetching, local file writes, image downloads, and local HTTP serving, but does not clearly warn users that using the skill will make outbound requests, persist untrusted remote content to disk, and expose that content over a local web server. In a skill ecosystem, missing disclosure increases the chance that users invoke side-effectful behavior without informed consent, which can create privacy, storage, and local exposure risks.

Content

No source excerpt is available for this finding.

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · README.md (reported line 144)May include surrounding context.

解决：

bash

# 检查图片目录
ls -la ~/.openclaw/workspace/images/

# 重启 HTTP 服务器
cd ~/.openclaw/workspace && python3 -m http.server 8080

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · README.md (reported line 197)May include surrounding context.

解决：

bash

# 检查图片目录
ls -la ~/.openclaw/workspace/images/

# 重启 HTTP 服务器
cd ~/.openclaw/workspace && python3 -m http.server 8080

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill documentation declares no explicit tool scope even though the behavior clearly involves outbound network access and local file writes. In agent environments, missing scope declarations weaken policy enforcement and informed consent, making it easier for the skill to operate with broader privileges than a user or orchestrator expects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill text does not prominently warn that it writes files and may expose them through a local HTTP server. This omission increases the chance of unintended data exposure or unsafe execution by users who believe the skill only downloads an article, especially since the example output advertises browser access without clarifying exposure boundaries.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The description states the skill will auto-trigger for broad user intents like saving, extracting, or downloading WeChat articles, which can match ordinary conversation without clear consent boundaries. In an agent environment, overly broad invocation increases the chance the skill activates on unintended requests and performs network fetching or content extraction when the user did not explicitly ask for this specific tool.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest includes generic trigger terms such as '微信文章', '公众号文章', and similar phrases that are not sufficiently scoped to a specific action or URL. This can cause accidental invocation on benign discussion, leading the agent to fetch external content or save data unexpectedly, which expands attack surface and may produce privacy or policy issues.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This JSON eval file contains prompts and expected outputs exclusively in Chinese, including required output descriptions such as "生成HTML文件" and user-facing instructions like "抓取这篇文章". Because no opt-in, language selection, or justification for a Chinese-only locale is documented in the file, this creates a natural-language policy concern under the language/locale rule.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script only warns on non-mp.weixin.qq.com URLs and then proceeds to fetch them if the caller confirms, despite the skill claiming support only for WeChat article links. In an agent setting, this weak validation can be abused as a generic URL fetch primitive, enabling SSRF-style access to internal services or unexpected retrieval of arbitrary resources reachable from the host.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This code saves the fetched HTML article to /root/.openclaw/workspace and creates image/media directories under the same location. Although the script prints status messages after creating and saving files, it does not disclose up front that running it will persist remote content and downloaded assets on disk, which is a safety-relevant file write behavior.

Content

No source excerpt is available for this finding.

Tainted flow: 'local_cover' from requests.get (line 180, network input) → open (file write)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · fetch.py (reported line 185)May include surrounding context.

python

if not os.path.exists(local_cover):
                resp = requests.get(cover_url, headers=headers, timeout=30)
                if resp.status_code == 200 and len(resp.content) > 100:
                    with open(local_cover, 'wb') as f:
                        f.write(resp.content)
            
            print(f"✓ 视频封面 {i+1} 已下载")

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill’s stated purpose is fetching WeChat article content, but it also launches a local HTTP server as a side effect. Adding a network service expands the attack surface and can unintentionally expose generated files or other accessible content to local-network users, which is not necessary for simple article retrieval.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script starts python3 -m http.server in the background without explicit consent or a clear warning that files may become accessible over the network. Because users may believe the tool only downloads an article, this hidden behavior can cause unintentional exposure of local data and make incident detection harder.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The natural-language instructions and examples are entirely in Chinese, including the invocation guidance that says the assistant will automatically recognize and fetch the article link. There is no statement offering another language or explaining that the skill is intentionally limited to Chinese-speaking users or a China-specific environment.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The manifest description and triggers are entirely Chinese-language, which can indicate a locale-specific interaction requirement. There is no explicit opt-in, language choice, or justification that the skill is intended only for Chinese-speaking or WeChat-specific environments.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The request headers force Accept-Language: zh-CN,zh;q=0.9,en;q=0.8, which imposes a specific language/locale preference. Under the policy, locale constraints should either be optional for the user or clearly justified as region-specific behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Comments and user-visible output such as the usage text and completion messages are written only in Chinese, which forces a specific language for interaction. The file does not offer multilingual support, opt-in language selection, or explain that the skill is intended only for a Chinese-speaking or region-specific context.

Content

No source excerpt is available for this finding.