ClawHub
Back to skill

Security audit

WeChat Article Reader

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward WeChat article reader with one install-provenance caution but no hidden or destructive behavior in the reviewed artifact.

Install from the reviewed ClawHub artifact or a pinned commit rather than an unpinned GitHub main-branch URL. Expect the skill to open only the WeChat article URL you provide and extract page text through the browser.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:17
Finding
Skill Installation from an Unpinned Mutable GitHub Branch## Vulnerability Details **File Location**: `README.md`, lines 17-18 **Vulnerability Type**: Supply-chain risk caused by an unpinned remote Skill source **Risk Level**: Medium ### Vulnerable Code ```bash # From GitHub openclaw skill install https://github.com/bernylinville/my-skills/blob/main/skills/wechat-article-reader/SKILL.md ``` ### Technical Analysis The documented installation command retrieves the Skill definition from the mutable `main` branch of a personal GitHub repository. It does not pin the source to a reviewed commit hash, immutable release artifact, checksum, or cryptographically verified signature. Consequently, the content installed by a user can differ from the version covered by this audit. Anyone who gains write access to the repository or compromises the maintainer account could replace `SKILL.md` with malicious Agent instructions. The affected content would then be trusted when users follow the documented installation procedure. The audited files do not themselves contain executable malicious code. The risk arises from the mutable installation source and its ability to deliver different Skill instructions after review. ### Attack Path 1. An attacker compromises the GitHub repository, its maintainer account, or another mechanism capable of changing the `main` branch. 2. The attacker modifies the remotely hosted `SKILL.md` to contain malicious or misleading Agent instructions. 3. A user follows the installation command in `README.md`. 4. OpenClaw retrieves the current remote file rather than the version examined during this audit. 5. When the installed Skill is invoked, the Agent follows the substituted instructions and may use available browser, file, network, or other tools within the permissions granted to the Agent. ### Impact Assessment Exploitation can replace the intended article-reading behavior with attacker-controlled Skill instructions. The resulting privileges are limited by the t ...[truncated 448 chars]
Remediation
## Remediation Suggestions - Replace the mutable `main` branch URL with a URL pinned to a specific reviewed Git commit. - Prefer a signed, versioned release artifact or a trusted Skill registry with provenance verification. - Publish a SHA-256 checksum for the reviewed `SKILL.md` and require users or installation tooling to verify it before installation. - Enable repository protections, mandatory review, signed commits or tags, and strong multi-factor authentication for maintainers. - Document a controlled upgrade process so that each new Skill version is reviewed before users install it. - If the installer supports integrity locks or manifests, record both the immutable source revision and expected content digest.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Skill Enumeration

Medium
Category
Agent Snooping
Content
openclaw skill install ./skills/wechat-article-reader

# From GitHub
openclaw skill install https://github.com/bernylinville/my-skills/blob/main/skills/wechat-article-reader/SKILL.md
```

## Usage
Confidence
80% confidence
Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Static analysis

No suspicious patterns detected.