ClawHub
Back to skill

Security audit

weibo-auto-post

Security checks for vulnerabilities and agentic risk

Overview

This skill is a real Weibo auto-posting workflow, but it can publish publicly without a final confirmation, run scheduled posting instructions, delete matching local files, and contains PowerShell command-injection risks in image-path handling.

Install only if you are comfortable giving this skill control over a logged-in Weibo session and local desktop automation. Before use, remove or disable default cleanup, avoid cron/unattended publishing, require a manual final confirmation before posting, and fix the PowerShell path handling so image paths are passed as data rather than executable command text.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/publish.py:94
Finding

PowerShell Command Injection Through the Publication Image Path

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/make_card.py:248
Finding

PowerShell Command Injection Through the Generated Image Output Path

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/publish.py:62
Finding

Overbroad Wildcard Cleanup Can Delete Unrelated User Files

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/publish.py:24
Finding

Unverified Coordinate-Based GUI Automation Can Publish or Act in the Wrong Window

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (18)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

This documented behavior includes undeclared side effects such as temporary screenshot storage and forced deletion of files from Pictures and TEMP directories. Hidden or under-declared destructive actions are dangerous because they reduce informed consent and can lead to data loss or privacy exposure when an agent runs the workflow automatically.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

This documented behavior includes undeclared side effects such as temporary screenshot storage and forced deletion of files from Pictures and TEMP directories. Hidden or under-declared destructive actions are dangerous because they reduce informed consent and can lead to data loss or privacy exposure when an agent runs the workflow automatically.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill documents shell and environment-dependent operations, including Python execution and PowerShell file deletion, but does not declare any explicit tool scope or permissions. This is dangerous because an agent may invoke filesystem and shell-capable tools more broadly than the user expects, increasing the chance of unintended command execution or destructive side effects.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger phrases are broad enough to match ordinary requests like helping write or post content, which can cause the skill to activate in contexts where the user did not intend browser automation or local file operations. In an agent environment, overbroad activation increases the risk of surprising execution and unintended posting actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The workflow includes system-impacting actions—browser automation, clipboard paste, screenshot-based UI interaction, and cleanup—but does not prominently warn the user that it may post content and modify local files. In the context of a social-media automation skill, this is especially risky because a mistaken run can cause irreversible public posting and local data changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The cleanup commands use forced deletion against wildcard paths in the user's Pictures and TEMP directories without an explicit safety warning or strong containment. This is dangerous because pattern-based deletion can remove unintended files, and the use of force suppresses prompts that might otherwise prevent accidental data loss.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The entire skill guidance is written as a prescriptive content template for Weibo posts in Chinese, with no indication that users may choose another language or locale. This creates a language/locale policy concern because it effectively forces a specific language without user opt-in or an explicit region-specific justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The guide instructs automated browser posting, writes to a local file, and deletes matching image files from a user directory, but it does not present explicit safety warnings, confirmation requirements, or guardrails around filesystem and account-impacting actions. In the context of a scheduled autonomous job, these actions can execute without real-time user review, increasing the risk of unintended posting, data loss, or account misuse if the workflow is misconfigured or triggered unexpectedly.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The module description explicitly presents the skill as a Chinese-language '微博配图生成器', and the built-in card content throughout the file is fixed in Chinese. Because there is no visible opt-in, alternative locale support, or documented region-specific justification, this constitutes a language/locale policy concern under the natural-language policy rule.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/make_card.py (reported line 256)May include surrounding context.

python
$img.Dispose()
Write-Output "CLIPBOARD_OK"
'''
    result = subprocess.run(["powershell", "-Command", ps_cmd], capture_output=True, text=True)
    if result.returncode == 0:
        print("[clipboard] OK")
    else:

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The verification function captures the entire screen rather than only the Weibo compose region. Full-screen screenshots can unintentionally collect sensitive information from unrelated applications, documents, notifications, or credentials visible on screen.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

A Weibo auto-posting skill is expected to automate the browser and use the clipboard, but spawning PowerShell to manipulate files and clipboard contents adds a general command-execution capability beyond the manifest's stated scope. This is especially notable because the subprocesses perform filesystem deletion and OS-level clipboard operations rather than purely browser automation.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/publish.py (reported line 71)May include surrounding context.

python
Get-ChildItem "$env:TEMP\\openclaw_screenshot_*.png" -EA SilentlyContinue | Remove-Item -Force -EA SilentlyContinue
Write-Output "CLEANUP_OK"
"""
    result = subprocess.run(["powershell", "-Command", ps_script], capture_output=True, text=True)
    if result.returncode == 0:
        print("[cleanup] OK")
    else:

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
98% confidence
Finding

The script builds a PowerShell command by interpolating args.image directly into source code passed to powershell -Command. An attacker can supply a crafted image path containing quotes or PowerShell metacharacters to break out of the string and execute arbitrary commands on the host.

Content

Scanner excerpt · scripts/publish.py (reported line 103)May include surrounding context.

python
$img.Dispose()
Write-Output "CLIPBOARD_OK"
'''
        result = subprocess.run(["powershell", "-Command", ps_cmd], capture_output=True, text=True)
        if result.returncode == 0:
            print(f"[clipboard] Image copied: {args.image}")
        else:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The automation clicks the publish button directly without a confirmation step, dry-run mode, or explicit final user approval. In a GUI automation context, coordinate-based actions can misfire or publish unintended content if the browser focus, layout, or page state changes.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The natural-language instructions force a specific language for all users, and the file does not provide any opt-in, alternative language, or explanation that the skill is limited to a Chinese-speaking or region-specific audience. Under the stated policy, fixed language requirements without user choice can be a locale-policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The cleanup routine deletes files matching broad patterns, including a hard-coded user Pictures path, without showing the user what will be removed. If filenames overlap with legitimate user files, this can cause unintended data loss, especially in the named directory.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest says the skill supports scenarios such as '发布定时微博' and '设置微博定时发布任务'. In this file, the code only waits short delays before interacting with the UI and then publishes immediately; there is no implementation of task scheduling, delayed execution at a specified time, or integration with any scheduler.

Content

No source excerpt is available for this finding.