T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/post_weibo.py:91- Finding
False Publication Success Corrupts Persistent Posting State
- Content
View full analysis
Vulnerability Details
File Location:
scripts/post_weibo.py, lines 91–115 and 173–178
Vulnerability Type: False success reporting and unverified persistent state mutation
Risk Level: MediumVulnerable Code:
python def post_to_weibo(content, use_quick_post=False): """ Post content to Weibo using browser automation. This is a reference implementation showing the workflow. In practice, you would use OpenClaw's browser tool directly. Args: content: Text content to post use_quick_post: Use quick post popup instead of main textbox Returns: bool: True if successful, False otherwise """ print(f"📝 Posting to Weibo...") print(f"Content: {content[:50]}{'...' if len(content) > 50 else ''}") print(f"Length: {len(content)} characters") # This is pseudocode - actual implementation uses OpenClaw browser tool steps = [ f"1. Open {WEIBO_URL}", "2. Take snapshot to get element refs", "3. Click textbox", "4. Type content", "5. Click send button", "6. Verify post appeared" ] print("\nSteps:") for step in steps: print(f" {step}") print("\n✅ Post workflow defined. Use OpenClaw browser tool to execute.") return Truepython success = post_to_weibo(content, use_quick_post=args.quick) if success: write_state(content) print("\n✅ Success! State updated.") return 0 else: print("\n❌ Failed to post.") return 1Technical Analysis
post_to_weibo()is explicitly a pseudocode implementation and performs no browser automation or network request. Nevertheless, it unconditionally returnsTrue. The caller interprets this value as proof that publication succeeded, callswrite_state(content), prints a success message, a ...[truncated 2140 chars]- Remediation
View remediation
Remediation Suggestions
- Do not return success from a pseudocode or unimplemented publication function. Raise
NotImplementedErroror returnFalse. - Do not call
write_state()unless publication has been positively verified through browser output or a confirmed Weibo response. - Separate workflow generation from execution. A documentation-only mode should use a distinct command and must not mutate state.
- Return a structured result containing publication status, verification evidence, and any remote post identifier.
- Commit state only after checking that the new post appears on the authenticated profile with matching content.
- Write state atomically using a temporary file and replacement to avoid partial records.
- Add tests asserting that failed, skipped, simulated, and unverified publication attempts never update the state file.
- Consider storing only the minimum required metadata, such as a timestamp and content hash, rather than complete post content.
A safe interim implementation would be:
python def post_to_weibo(content, use_quick_post=False): raise NotImplementedError( "Browser publication is not implemented by this standalone script" )- Do not return success from a pseudocode or unimplemented publication function. Raise