T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:25- Finding
Unverified Mutable Remote Code Is Downloaded and Executed
- Content
View full analysis
- Remediation
View remediation
Security audit
wewe-rss-deploy
Security checks for vulnerabilities and agentic risk
Overview
This skill appears to deploy the promised WeWe RSS service, but it uses high-impact deployment defaults that need careful review before installation.
Review this before installing. Prefer pinning the upstream repository to a known commit, verifying downloads, using localhost binding, generating a strong auth code, avoiding the default third-party relay unless you trust it, and enabling PM2 startup only after explicit approval. Run it in a contained environment if possible.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T06 · System Persistence
Error
- Location
SKILL.md:133- Finding
Downloaded Application Is Configured for Cross-Session Startup Persistence
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:77- Finding
Service Is Exposed on All Interfaces with a Predictable Authorization Placeholder
- Content
View full analysis
- Remediation
View remediation
other
Warning
- Location
SKILL.md:90- Finding
Authentication-Related Traffic Is Routed Through an Unverified Third-Party Relay
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
Findings (18)
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 60% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md # SKILL.md - 部署 WeWe RSS 微信公众号 RSS 服务 ## 触发条件 当 WeWe RSS 服务未运行（端口 4000 无响应），或用户要求部署 WeWe RSS 项目时激活。
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
unzip -o /tmp/wewe-rss.zip -d ~/.openclaw/workspace/
清理
rm /tmp/wewe-rss.zip
text ### Step 2：安装依赖
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
rm -rf prisma/recursively deletes a directory inside the checked-out project as part of schema switching. Although intended to replace MySQL schema files with SQLite ones, recursive deletion is hazardous if executed from the wrong path or if path assumptions fail, making this a real safety risk in an automated skill.- Content
md ls prisma/ # 删除 MySQL schema（如果存在） rm -rf prisma/ # 重命名 SQLite schema mv prisma-sqlite prisma
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
│ │ │ └── wewe-rss.db │ │ ├── dist/ # 构建输出 │ │ ├── prisma/ # 数据库 schema │ │ └── .env # 环境配置 │ └── data/ # 数据文件软链接 └── package.json
text
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
rm -rf ~/.openclaw/workspace/wewe-rss-mainis a real destructive command, even though it is part of an uninstall section. In an agent context, providing unattended deletion steps without confirmation can lead to accidental data loss if the directory contains user modifications or if the path is reused for other work.- Content
md pm2 delete wewe-rss # 删除项目 rm -rf ~/.openclaw/workspace/wewe-rss-main # 清理配置 rm -f ~/.openclaw/workspace/tools/wewe-rss-config.txt
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
rm -rf ~/.openclaw/workspace/wewe-rss-mainis a real destructive command, even though it is part of an uninstall section. In an agent context, providing unattended deletion steps without confirmation can lead to accidental data loss if the directory contains user modifications or if the path is reused for other work.- Content
md pm2 delete wewe-rss # 删除项目 rm -rf ~/.openclaw/workspace/wewe-rss-main # 清理配置 rm -f ~/.openclaw/workspace/tools/wewe-rss-config.txt
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
rm -rf ~/.openclaw/workspace/wewe-rss-main
清理配置
rm -f ~/.openclaw/workspace/tools/wewe-rss-config.txt
text ---
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger condition activates whenever the service is down or when a user generically asks to deploy the project, which is broad enough to cause the agent to perform installation and service-start actions without narrowly scoped confirmation. In a skill system, overly broad activation raises the chance of unintended code download, dependency installation, and network exposure on the host.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The skill instructs the agent to fetch code from external network sources (
git cloneorcurlfrom GitHub) and then execute build/install steps on that code. This is expected for deployment, but it remains a genuine supply-chain and external transmission risk because unreviewed remote content is imported into the environment and later executed.- Content
git clone https://github.com/cooderl/wewe-rss.git ~/.openclaw/workspace/wewe-rss-main
text 如果 Git 克隆失败，使用 curl 下载压缩包： ```bash # 下载 curl -L "https://github.com/cooderl/wewe-rss/archive/refs/heads/main.zip" -o /tmp/wewe-rss.zip
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
创建数据目录：
bash mkdir -p ~/.openclaw/workspace/wewe-rss-main/apps/server/data mkdir -p ~/.openclaw/workspace/wewe-rss-main/apps/data
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
创建数据目录:
bash mkdir -p ~/.openclaw/workspace/wewe-rss-main/apps/server/data mkdir -p ~/.openclaw/workspace/wewe-rss-main/apps/data
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The
.envexample binds the service to0.0.0.0, exposing it on all network interfaces, yet the skill does not clearly warn that this makes the RSS service reachable beyond localhost. Combined with a web UI and article/account management features, this can unintentionally expose a locally deployed service to other users on the network or the internet if port forwarding/firewall rules permit it.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill recommends a public third-party forwarding service (
PLATFORM_URL) without a privacy or trust warning. Because the service is used in a workflow involving account login and retrieval of reading/article data, users may unknowingly transmit sensitive metadata or content through infrastructure they do not control.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 91% confidence
- Finding
Writing the installation path into
~/.openclaw/workspace/tools/wewe-rss-config.txtcreates cross-session state intended for later skills to discover and reuse. In an agent environment, this is persistence behavior that can influence future runs and should be disclosed and consented to, especially because it affects tool behavior beyond the current task.- Content
为了后续 Skill 能够找到项目，将路径写入配置：
bash mkdir -p ~/.openclaw/workspace/tools/ echo "~/.openclaw/workspace/wewe-rss-main" > ~/.openclaw/workspace/tools/wewe-rss-config.txt
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The entire skill documentation is written in Chinese and assumes Chinese UI flows such as WeChat Reading login, without indicating that language is fixed or offering an alternative language option. This can be a locale-policy issue when a skill implicitly forces a specific language without user opt-in or justification.
- Content