T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/post_weibo.py:91
- Finding
- False Publication Success Corrupts Persistent Posting State## Vulnerability Details **File Location**: `scripts/post_weibo.py`, lines 91–115 and 173–178 **Vulnerability Type**: False success reporting and unverified persistent state mutation **Risk Level**: Medium **Vulnerable Code**: ```python def post_to_weibo(content, use_quick_post=False): """ Post content to Weibo using browser automation. This is a reference implementation showing the workflow. In practice, you would use OpenClaw's browser tool directly. Args: content: Text content to post use_quick_post: Use quick post popup instead of main textbox Returns: bool: True if successful, False otherwise """ print(f"📝 Posting to Weibo...") print(f"Content: {content[:50]}{'...' if len(content) > 50 else ''}") print(f"Length: {len(content)} characters") # This is pseudocode - actual implementation uses OpenClaw browser tool steps = [ f"1. Open {WEIBO_URL}", "2. Take snapshot to get element refs", "3. Click textbox", "4. Type content", "5. Click send button", "6. Verify post appeared" ] print("\nSteps:") for step in steps: print(f" {step}") print("\n✅ Post workflow defined. Use OpenClaw browser tool to execute.") return True ``` ```python success = post_to_weibo(content, use_quick_post=args.quick) if success: write_state(content) print("\n✅ Success! State updated.") return 0 else: print("\n❌ Failed to post.") return 1 ``` ### Technical Analysis `post_to_weibo()` is explicitly a pseudocode implementation and performs no browser automation or network request. Nevertheless, it unconditionally returns `True`. The caller interprets this value as proof that publication succeeded, calls `write_state(content)`, prints a success message, a ...[truncated 2140 chars]
- Remediation
- ## Remediation Suggestions 1. Do not return success from a pseudocode or unimplemented publication function. Raise `NotImplementedError` or return `False`. 2. Do not call `write_state()` unless publication has been positively verified through browser output or a confirmed Weibo response. 3. Separate workflow generation from execution. A documentation-only mode should use a distinct command and must not mutate state. 4. Return a structured result containing publication status, verification evidence, and any remote post identifier. 5. Commit state only after checking that the new post appears on the authenticated profile with matching content. 6. Write state atomically using a temporary file and replacement to avoid partial records. 7. Add tests asserting that failed, skipped, simulated, and unverified publication attempts never update the state file. 8. Consider storing only the minimum required metadata, such as a timestamp and content hash, rather than complete post content. A safe interim implementation would be: ```python def post_to_weibo(content, use_quick_post=False): raise NotImplementedError( "Browser publication is not implemented by this standalone script" ) ```