ClawHub
Back to skill

Security audit

WeChat Article Exporter

Security checks for vulnerabilities and agentic risk

Overview

This WeChat screenshot skill appears to perform its stated export function, but it weakens browser protections and uses automation-evasion settings while loading remote pages.

Review before installing. Use it only for WeChat article URLs you intend to export, and run it in a low-privilege, disposable environment with no mounted secrets or browser profiles, restricted network access, and memory/disk/runtime limits. The automation-evasion and disabled sandbox settings are the main concerns; they are not evidence of theft, but they increase operational and host-risk exposure.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/wechat_screenshot.py:54
Finding

Chromium Sandbox Disabled While Processing Remote Content

Content
View full analysis

Vulnerability Details

File Location: scripts/wechat_screenshot.py, lines 54–55
Vulnerability Type: Browser sandbox removal
Risk Level: High

Vulnerable Code:

python
"--no-sandbox",
"--disable-setuid-sandbox",

Technical Analysis

The script launches Chromium to process remote, potentially attacker-influenced web content while explicitly disabling Chromium's sandbox and setuid sandbox. The sandbox is a defense-in-depth boundary intended to isolate compromised renderer processes from the host environment.

Disabling these protections does not independently create a browser exploit, but it materially increases the consequences of a Chromium or rendering-engine vulnerability. A malicious or compromised WeChat article could serve crafted HTML, JavaScript, media, fonts, or images designed to exploit an unpatched browser flaw. Without the sandbox, successful renderer exploitation may gain access equivalent to the account running this skill.

Attack Path

  1. An attacker publishes or compromises an article under an accepted https://mp.weixin.qq.com/s/... URL.
  2. The attacker embeds content designed to exploit a vulnerability in the installed Chromium version.
  3. A user invokes the skill with the malicious article URL.
  4. The script launches Chromium with --no-sandbox and --disable-setuid-sandbox.
  5. Chromium processes the hostile page and its subresources.
  6. If exploitation succeeds, the missing sandbox allows the attacker to operate in the browser process's host security context rather than remaining confined by Chromium's normal isolation.

Impact Assessment

Exploitation depends on a separate browser vulnerability, but successful exploitation could provide the privileges of the operating-system account running the skill. Depending on deployment isolation and mounted resources, this may expose readable files, environment data, writable output paths, available network services, and th ...[truncated 174 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove --no-sandbox and --disable-setuid-sandbox, and run Chromium with its supported sandbox enabled.
  • Execute the skill under a dedicated, unprivileged operating-system account.
  • Keep Chromium and Playwright patched to supported versions.
  • If environmental constraints make sandbox removal unavoidable, execute each job in a disposable, tightly restricted container or virtual machine.
  • Drop Linux capabilities, prohibit privileged container mode, use a read-only root filesystem, and mount only a dedicated output directory.
  • Do not expose secrets, credential stores, host sockets, browser profiles, or broad host filesystem mounts to the execution environment.
  • Apply CPU, memory, process, and execution-time limits.
  • Restrict outbound network access to destinations required for the screenshot workflow.
  • Document sandbox removal as an exceptional deployment requirement rather than enabling it by default.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/wechat_screenshot.py:243
Finding

Unbounded Remote-Controlled Image Allocation Enables Resource Exhaustion

Content
View full analysis

Vulnerability Details

File Location: scripts/wechat_screenshot.py, lines 243–244
Vulnerability Type: Uncontrolled memory and output allocation
Risk Level: Medium

Vulnerable Code:

python
combined_height_px = total_height * int(dpr)
combined = Image.new('RGB', (seg_width, combined_height_px), (255, 255, 255))

Technical Analysis

total_height is derived from the dimensions reported by the remotely loaded page. The script does not impose a maximum document height, physical pixel count, segment count, output size, or memory budget before allocating a combined RGB image.

Pillow generally requires approximately three bytes per pixel for an RGB image before accounting for library and processing overhead. Consequently, a sufficiently large page height can trigger a very large contiguous allocation. The screenshot loop also creates a number of temporary segment files based on the page height, and PNG/PDF encoding adds further CPU, memory, and disk usage.

Temporary segment deletion occurs only after successful image composition and saving. If allocation, decoding, composition, or encoding fails, those files may remain and contribute to disk exhaustion.

Attack Path

  1. An attacker creates or compromises an accepted WeChat article whose rendered DOM produces an exceptionally large document height.
  2. A user submits the article URL to the skill.
  3. The script scrolls the page and accepts the remote document height without an upper bound.
  4. It captures a correspondingly large number of screenshot segments.
  5. It calculates combined_height_px from the attacker-influenced height and device-pixel ratio.
  6. Image.new attempts to allocate a huge RGB canvas, after which composition and PNG/PDF generation consume additional resources.
  7. The worker may become unresponsive, be terminated by the out-of-memory handler, exceed execution limits, or fill available storage with output and residual tempor ...[truncated 528 chars]
Remediation
View remediation

Remediation Suggestions

  • Define strict limits for CSS document height, physical pixel dimensions, total pixel count, screenshot segment count, execution time, and final output size.
  • Validate dimensions before capturing segments or allocating the combined canvas. Reject pages exceeding any configured threshold.
  • Estimate required memory before allocation using width × height × bytes per pixel plus a conservative processing overhead factor.
  • Avoid constructing one unbounded in-memory image. Use bounded tiles, streaming image processing, or a format/workflow that can compose output incrementally.
  • Apply process-level memory, CPU, runtime, and filesystem quotas.
  • Store temporary files in a dedicated directory with a size quota.
  • Place segment cleanup in a finally block so files are removed after failures and cancellations.
  • Validate dimensions again before PDF conversion because conversion can require additional memory.
  • Return a controlled error message when limits are exceeded rather than continuing partial processing.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Lp1

High
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The script performs outbound network access to user-supplied URLs via Playwright, but the finding indicates that this capability is not declared in the skill's permissions. Even though the code restricts targets to mp.weixin.qq.com, undeclared network access is a real security-relevant issue because it expands the skill's runtime capabilities beyond what operators or users may expect and can enable unreviewed data exchange.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/wechat_screenshot.py (reported line 79)May include surrounding context.

python
"--no-default-browser-check",
                    "--no/experiments/switches",
                    "--safebrowsing-disable-auto-update",
                    "--use-mock-keychain",
                    "--allow-pre-commit-input",
                    "--hide-scrollbars",
                    "--mute-audio",

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The code contains extensive anti-detection and automation-evasion behavior, including disabling automation indicators, spoofing browser properties, and suppressing browser safety features. In this context, that is dangerous because it is not necessary for basic screenshot functionality and materially increases the skill's ability to bypass platform defenses, rate limits, or abuse detection.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This code hard-codes locale="zh-CN" and timezone_id="Asia/Shanghai", which is a natural-language locale policy issue under the rule because it imposes a specific language/region context without user opt-in. Although the target site is WeChat, the file does not present this as a documented user choice or explicit region-specific compliance requirement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest and documentation are entirely in Chinese, which effectively constrains use to a specific language without stating that this is optional or region-specific. The policy requires either user language choice or a clearly justified locale limitation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger phrases are broad enough to match generic requests like '微信截图' or '公众号导出', which can cause the skill to activate when the user did not specifically request article export. Over-broad activation increases the chance of unintended tool execution against user-provided links or content, especially because the skill is allowed to invoke Bash.

Content

No source excerpt is available for this finding.