wewe-rss-deploy

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:42 AM UTC
• Version: 1.0.1

Overview

This skill appears to deploy the promised WeWe RSS service, but it uses high-impact deployment defaults that need careful review before installation.

Review this before installing. Prefer pinning the upstream repository to a known commit, verifying downloads, using localhost binding, generating a strong auth code, avoiding the default third-party relay unless you trust it, and enabling PM2 startup only after explicit approval. Run it in a contained environment if possible.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:25
• Finding: Unverified Mutable Remote Code Is Downloaded and Executed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 25-43, with subsequent execution at lines 109-135 **Vulnerability Type**: Mutable remote payload and unsafe dependency execution **Risk Level**: High ### Vulnerable Code ```bash git clone https://github.com/cooderl/wewe-rss.git ~/.openclaw/workspace/wewe-rss-main ``` ```bash curl -L "https://github.com/cooderl/wewe-rss/archive/refs/heads/main.zip" -o /tmp/wewe-rss.zip unzip -o /tmp/wewe-rss.zip -d ~/.openclaw/workspace/ rm /tmp/wewe-rss.zip ``` ```bash cd ~/.openclaw/workspace/wewe-rss-main pnpm install ``` ```bash npx prisma generate npx prisma migrate deploy pnpm run -r build pnpm run start:server ``` ### Technical Analysis The deployment retrieves the mutable default branch of an external repository instead of a reviewed, immutable commit or release. Neither the Git workflow nor the ZIP fallback verifies a commit identifier, cryptographic signature, or expected digest. The retrieved project is subsequently passed to `pnpm install`, build scripts, Prisma commands, and the server startup command. Package installation may execute dependency lifecycle scripts, while project build and startup scripts execute code defined by the remotely retrieved repository. In addition, `npx` may resolve or retrieve a package if the expected local executable is unavailable. The use of GitHub is consistent with the declared deployment function, but retrieving mutable code and executing it without integrity verification exceeds the minimum trust necessary. A reviewed release or pinned commit would provide the same functionality with substantially less supply-chain risk. ### Attack Path 1. An attacker compromises the upstream repository, its maintainer account, or a transitive package. 2. The attacker modifies the `main` branch, package metadata, lifecycle scripts, build scripts, or server code. 3. The Skill clones the changed branch or dow ...[truncated 895 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin the source to a reviewed commit SHA or immutable, versioned release rather than `main`. - Publish and verify a SHA-256 digest or cryptographic signature before extracting or executing the archive. - Abort deployment when verification fails; do not silently fall back to an unverified source. - Require a committed lockfile and use `pnpm install --frozen-lockfile`. - Review dependency lifecycle scripts and consider disabling them during installation unless explicitly required. - Invoke only a verified project-local Prisma executable rather than allowing `npx` to retrieve an unexpected package. - Pin all deployment tools, including PM2, to reviewed versions. - Run installation and build operations in a restricted container or dedicated unprivileged account with minimal filesystem and network access. ]]>

T06 · System Persistence

Error

• Location: SKILL.md:133
• Finding: Downloaded Application Is Configured for Cross-Session Startup Persistence<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 133-142 **Vulnerability Type**: Operating-system startup persistence **Risk Level**: High ### Vulnerable Code ```bash npm install -g pm2 cd ~/.openclaw/workspace/wewe-rss-main pm2 start apps/server/dist/main.js --name wewe-rss pm2 save pm2 startup ``` ### Technical Analysis `pm2 save` records the current process list, and `pm2 startup` configures integration with the host startup mechanism. Consequently, code downloaded from the external repository can execute in future sessions and after system reboot. Long-running service operation may be a useful optional deployment feature, but automatic startup is not necessary to build, configure, verify, or interactively run the declared RSS service. It crosses a persistence boundary and should require separate, informed user approval. The risk is amplified because the persisted application and its dependencies are obtained from mutable, unverified sources. The global PM2 installation also changes the user's or system's tool environment beyond the project directory. Depending on npm configuration and operating-system permissions, this step may require elevated privileges. ### Attack Path 1. The deployment retrieves the application and dependencies from mutable upstream sources. 2. A compromised application or dependency is built into `apps/server/dist/main.js`. 3. PM2 launches the resulting server process. 4. `pm2 save` stores the process definition. 5. `pm2 startup` installs or enables a startup integration. 6. The attacker-controlled process returns after logout, session termination, or reboot without rerunning the Skill. ### Impact Assessment Exploitation provides durable execution with the privileges assigned to the PM2 startup process. At minimum, this may include continued access to the deploying user's files, application database, environment configuration, and network. If the startu ...[truncated 274 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove `pm2 save` and `pm2 startup` from the default deployment procedure. - Run the server interactively by default and verify it before offering persistence. - Present startup persistence as a separate, opt-in action requiring explicit user confirmation. - Pin and locally install PM2 instead of performing an unversioned global installation. - Display the generated startup command and service definition for review before execution. - Configure the service under a dedicated, unprivileged account with filesystem and network restrictions. - Use operating-system service hardening controls, including restricted writable paths, environment-file permissions, restart limits, and explicit working directories. - Document and provide a complete removal procedure for both the PM2 process and its startup integration. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:77
• Finding: Service Is Exposed on All Interfaces with a Predictable Authorization Placeholder<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 77-84, with firewall guidance at line 222 **Vulnerability Type**: Insecure authentication and network exposure configuration **Risk Level**: High ### Vulnerable Code ```env HOST=0.0.0.0 PORT=4000 DATABASE_URL="file:../data/wewe-rss.db" DATABASE_TYPE="sqlite" AUTH_CODE=your-secret-code-here ``` The troubleshooting guidance also recommends ensuring that port 4000 is open when the service cannot be reached. ### Technical Analysis Binding to `0.0.0.0` makes the service listen on every available network interface rather than limiting it to localhost. At the same time, the example authorization code is a publicly documented and predictable placeholder. Although the accompanying text recommends choosing a complex password, no command generates a random secret and no validation step prevents deployment with the placeholder unchanged. Opening the firewall for port 4000 can turn this weak default into remote exposure. The service URL uses plaintext HTTP, and the instructions do not require a TLS reverse proxy, source-address restrictions, or rate-limited authentication. Creating a project-local `.env` is appropriate for application configuration and does not, by itself, indicate credential theft. The security issue is that the Skill encourages an externally reachable configuration without enforcing a strong secret or secure transport. ### Attack Path 1. A user copies the provided `.env` template without replacing `your-secret-code-here`. 2. The application binds to all network interfaces on port 4000. 3. The user follows the troubleshooting advice and opens the relevant firewall port, or the host is already reachable on the local network. 4. An attacker discovers the listening service through network scanning. 5. The attacker attempts the documented placeholder authorization code or intercepts credentials over plaintext HTTP. 6. If accepted, t ...[truncated 555 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Default `HOST` to `127.0.0.1` or `::1`. - Generate the authorization code with a cryptographically secure random generator during deployment. - Refuse to start when the code is empty, weak, or equal to the documented placeholder. - Set restrictive permissions on `.env`, such as owner read/write only. - Require explicit confirmation before binding to a non-loopback address or modifying firewall exposure. - For remote access, place the service behind a TLS-enabled reverse proxy and restrict source addresses where practical. - Add authentication throttling, lockout controls, and security logging. - Do not recommend broadly opening port 4000; provide narrowly scoped firewall rules instead. ]]>

other

Warning

• Location: SKILL.md:90
• Finding: Authentication-Related Traffic Is Routed Through an Unverified Third-Party Relay<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 90-91, with login workflow at lines 174-184 **Vulnerability Type**: Third-party relay privacy and integrity risk **Risk Level**: Medium ### Vulnerable Code ```env PLATFORM_URL="https://weread.111965.xyz" ``` The documented workflow subsequently directs the user to add an account by scanning a WeChat Reading login QR code. ### Technical Analysis The Skill configures an external domain as the WeChat Reading forwarding service. The domain is not the declared project repository domain, and the documentation does not establish its operator, source code, retention policy, transmitted fields, integrity guarantees, or relationship to the upstream service. TLS protects traffic in transit only to the configured relay; it does not prevent the relay operator from observing or altering application-layer data. Because the login and content-retrieval workflow depends on this endpoint, the relay may receive authentication-related metadata, identifiers, requested publication information, or protocol data. The exact fields cannot be confirmed from the two audited files, so direct credential theft is not asserted. The external relay may support the declared functionality, but making it the default without informed consent or a documented self-hosted alternative creates avoidable trust and privacy exposure. ### Attack Path 1. The user deploys the supplied configuration with the default `PLATFORM_URL`. 2. The user initiates the documented QR-code login and subsequent feed operations. 3. The deployed service communicates with the third-party relay. 4. A malicious or compromised relay observes metadata or modifies responses exchanged through it. 5. Manipulated data is processed by the locally deployed application, or observed data is retained and correlated by the relay operator. ### Impact Assessment Potential impact includes loss of privacy concerning account- ...[truncated 426 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Prefer an official endpoint or a self-hosted relay controlled by the user. - Do not enable an unrelated third-party relay by default. - Require explicit informed consent before sending authentication-related traffic to an external operator. - Document the relay owner, source code, transmitted data fields, retention policy, and security assumptions. - Allow the endpoint to be configured interactively and validate that HTTPS is used. - Pin or otherwise verify the expected endpoint identity where operationally feasible. - Minimize transmitted data and avoid forwarding reusable authentication secrets. - Provide instructions for auditing and deploying the relay locally. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (18)

Hidden Instructions

High

• Category: Prompt Injection

Content

# SKILL.md - 部署 WeWe RSS 微信公众号 RSS 服务

## 触发条件
当 WeWe RSS 服务未运行（端口 4000 无响应），或用户要求部署 WeWe RSS 项目时激活。

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

unzip -o /tmp/wewe-rss.zip -d ~/.openclaw/workspace/

# 清理
rm /tmp/wewe-rss.zip
```

### Step 2：安装依赖

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

ls prisma/

# 删除 MySQL schema（如果存在）
rm -rf prisma/

# 重命名 SQLite schema
mv prisma-sqlite prisma

• Confidence: 85% confidence
• Finding: `rm -rf prisma/` recursively deletes a directory inside the checked-out project as part of schema switching. Although intended to replace MySQL schema files with SQLite ones, recursive deletion is hazardous if executed from the wrong path or if path assumptions fail, making this a real safety risk in an automated skill.

Credential Access

High

• Category: Privilege Escalation

Content

│   │   │   └── wewe-rss.db
│   │   ├── dist/              # 构建输出
│   │   ├── prisma/            # 数据库 schema
│   │   └── .env               # 环境配置
│   └── data/                  # 数据文件软链接
└── package.json
```

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

pm2 delete wewe-rss

# 删除项目
rm -rf ~/.openclaw/workspace/wewe-rss-main

# 清理配置
rm -f ~/.openclaw/workspace/tools/wewe-rss-config.txt

• Confidence: 90% confidence
• Finding: `rm -rf ~/.openclaw/workspace/wewe-rss-main` is a real destructive command, even though it is part of an uninstall section. In an agent context, providing unattended deletion steps without confirmation can lead to accidental data loss if the directory contains user modifications or if the path is reused for other work.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

pm2 delete wewe-rss

# 删除项目
rm -rf ~/.openclaw/workspace/wewe-rss-main

# 清理配置
rm -f ~/.openclaw/workspace/tools/wewe-rss-config.txt

• Confidence: 90% confidence
• Finding: `rm -rf ~/.openclaw/workspace/wewe-rss-main` is a real destructive command, even though it is part of an uninstall section. In an agent context, providing unattended deletion steps without confirmation can lead to accidental data loss if the directory contains user modifications or if the path is reused for other work.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

rm -rf ~/.openclaw/workspace/wewe-rss-main

# 清理配置
rm -f ~/.openclaw/workspace/tools/wewe-rss-config.txt
```
---

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger condition activates whenever the service is down or when a user generically asks to deploy the project, which is broad enough to cause the agent to perform installation and service-start actions without narrowly scoped confirmation. In a skill system, overly broad activation raises the chance of unintended code download, dependency installation, and network exposure on the host.

External Transmission

Medium

• Category: Data Exfiltration

Content

git clone https://github.com/cooderl/wewe-rss.git ~/.openclaw/workspace/wewe-rss-main
```

如果 Git 克隆失败，使用 curl 下载压缩包：
```bash
# 下载
curl -L "https://github.com/cooderl/wewe-rss/archive/refs/heads/main.zip" -o /tmp/wewe-rss.zip

• Confidence: 90% confidence
• Finding: The skill instructs the agent to fetch code from external network sources (`git clone` or `curl` from GitHub) and then execute build/install steps on that code. This is expected for deployment, but it remains a genuine supply-chain and external transmission risk because unreviewed remote content is imported into the environment and later executed.

Session Persistence

Medium

• Category: Rogue Agent

Content

**创建数据目录：**
```bash
mkdir -p ~/.openclaw/workspace/wewe-rss-main/apps/server/data
mkdir -p ~/.openclaw/workspace/wewe-rss-main/apps/data
```

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

**创建数据目录:**
```bash
mkdir -p ~/.openclaw/workspace/wewe-rss-main/apps/server/data
mkdir -p ~/.openclaw/workspace/wewe-rss-main/apps/data
```

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The `.env` example binds the service to `0.0.0.0`, exposing it on all network interfaces, yet the skill does not clearly warn that this makes the RSS service reachable beyond localhost. Combined with a web UI and article/account management features, this can unintentionally expose a locally deployed service to other users on the network or the internet if port forwarding/firewall rules permit it.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill recommends a public third-party forwarding service (`PLATFORM_URL`) without a privacy or trust warning. Because the service is used in a workflow involving account login and retrieval of reading/article data, users may unknowingly transmit sensitive metadata or content through infrastructure they do not control.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Session Persistence

Medium

• Category: Rogue Agent

Content

为了后续 Skill 能够找到项目，将路径写入配置：
```bash
mkdir -p ~/.openclaw/workspace/tools/
echo "~/.openclaw/workspace/wewe-rss-main" > ~/.openclaw/workspace/tools/wewe-rss-config.txt
```

• Confidence: 91% confidence
• Finding: Writing the installation path into `~/.openclaw/workspace/tools/wewe-rss-config.txt` creates cross-session state intended for later skills to discover and reuse. In an agent environment, this is persistence behavior that can influence future runs and should be disclosed and consented to, especially because it affects tool behavior beyond the current task.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: The entire skill documentation is written in Chinese and assumes Chinese UI flows such as WeChat Reading login, without indicating that language is fixed or offering an alternative language option. This can be a locale-policy issue when a skill implicitly forces a specific language without user opt-in or justification.

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: SKILL.md:240