ClawHub
Back to skill

Security audit

WeChat Proactive Push

Security checks for vulnerabilities and agentic risk

Overview

This skill openly enables proactive WeChat messaging that bypasses the 24-hour window, reads local OpenClaw WeChat account context, and documents optional recurring silent probes.

Install only if you control the OpenClaw WeChat account, are authorized to message the configured recipient, and understand the platform and account risks of bypassing the 24-hour window. Avoid enabling the recurring probe cron unless you need it, review existing OpenClaw cron entries afterward, and treat the local OpenClaw account/context-token files as sensitive.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
lib/wechat_push.py:94
Finding

Broad Access to Credential-Adjacent OpenClaw Account Data

Content
View full analysis
/dev/null } ``` ### Technical Analysis The Skill directly enumerates and parses OpenClaw context-token and bot-account files. These files are credential-adjacent resources and may contain authentication material or mappings between bot accounts and WeChat users. The context lookup supports the declared account-selection function. However, the implementation obtains access to the complete contents of every matching context-token file rather than requesting only the account identifier associated with the configured recipient. The verification command similarly parses complete bot-account JSON documents merely to determine whether they contain valid JSON. No credential exfiltration, intentional secret printing, or privilege escalation was found. Nevertheless, th ...[truncated 1403 chars]
Remediation
View remediation

T06 · System Persistence

Warning
Location
SKILL.md:124
Finding

Optional Recurring Agent Task Creates Cross-Session Persistence

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (17)

Natural-Language Policy Violations

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill explicitly advertises bypassing WeChat's 24-hour messaging restriction by using an internal plugin channel, which is a deliberate circumvention of platform-enforced communication boundaries. That makes the skill dangerous because it enables unsolicited messaging outside intended controls and can be used for spam, harassment, account abuse, or violation of platform security and policy constraints.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill is explicitly designed to proactively send WeChat messages and to bypass the platform's normal 24-hour messaging restriction, yet it does not present a clear warning about consent, recipient authorization, account risk, or privacy implications. In this context, the omission is especially dangerous because users may deploy automation that sends messages to individuals without informed consent or in violation of platform rules.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The README promotes silent proactive message pushes and health probes to a user's personal WeChat without any discussion of recipient consent, notification expectations, retention, or abuse controls. In a messaging skill targeting real users, this omission materially increases the risk of covert contact, spam, surveillance-like liveness checking, and non-compliant use of personal communication channels.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill instructs users to run installation and command-line workflows that invoke shell commands and access local files, but the manifest declares no tool scope or permission boundaries. In an agent environment, this can cause the skill to execute with implicit or overly broad capabilities, making command execution and local data access less auditable and easier to abuse.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest includes broad trigger phrases such as general requests about sending WeChat messages and troubleshooting terms, which can cause the skill to activate during ordinary conversation without clear intent to install or use it. Because this skill performs proactive messaging and shell-oriented setup, accidental activation increases the chance of unintended command execution or privacy-impacting actions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The file presents its title, description, and usage text entirely in Chinese, and the rest of the script continues this pattern for user-facing status and remediation messages. This imposes a specific language on users without opt-in, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · install.sh (reported line 80)May include surrounding context.

sh
if [ ! -f "$CONFIG_FILE" ]; then
    cp "${SKILL_DIR}/templates/config.example" "$CONFIG_FILE"
    chmod 600 "$CONFIG_FILE"
    echo ""
    echo "  配置文件已创建：$CONFIG_FILE"
    echo "  请编辑填入你的 openid（问 OpenClaw 微信插件拿）"

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · install.sh (reported line 93)May include surrounding context.

sh
if [ ! -f "$CONFIG_FILE" ]; then
    cp "${SKILL_DIR}/templates/config.example" "$CONFIG_FILE"
    chmod 600 "$CONFIG_FILE"
    echo ""
    echo "  配置文件已创建：$CONFIG_FILE"
    echo "  请编辑填入你的 openid（问 OpenClaw 微信插件拿）"

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · install.sh (reported line 143)May include surrounding context.

sh
# 5. 链接到 ~/.local/bin
echo ""
echo -e "${BLUE}5. 链接到 ~/.local/bin/${NC}"
mkdir -p "$LOCAL_BIN"
for cmd in wechat-push wechat-push-verify wechat-push-doctor; do
    ln -sf "${SKILL_DIR}/bin/${cmd}" "${LOCAL_BIN}/${cmd}"
    echo -e "  ${GREEN}✅ ${LOCAL_BIN}/${cmd}${NC}"

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · lib/wechat_push.py (reported line 188)May include surrounding context.

python
cmd.append("--silent")

    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=20)
    except subprocess.TimeoutExpired:
        return False, "openclaw message send timeout (20s)"
    except FileNotFoundError:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The document explicitly tells readers how to obtain user/openid-related identifiers and where to find local context-token files under the operator’s home directory. In the context of a skill whose purpose is proactive WeChat message delivery and bypassing platform messaging limits, exposing filesystem paths to account and context-token material materially lowers the barrier to harvesting sensitive tokens and abusing a bot account for unauthorized messaging.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

SQP-3 applies to all file types and covers language or locale policy violations. This troubleshooting guide presents all operational instructions exclusively in Chinese, with no opt-in, alternative language, or stated region-specific justification, which can violate an organizational policy requiring user language choice.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/troubleshooting.md (reported line 92)May include surrounding context.

修法：

bash
# 重启 OpenClaw 微信插件
launchctl unload ~/Library/LaunchAgents/com.openclaw.wechat-tunnel.plist
launchctl load ~/Library/LaunchAgents/com.openclaw.wechat-tunnel.plist

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/troubleshooting.md (reported line 93)May include surrounding context.

修法：

bash
# 重启 OpenClaw 微信插件
launchctl unload ~/Library/LaunchAgents/com.openclaw.wechat-tunnel.plist
launchctl load ~/Library/LaunchAgents/com.openclaw.wechat-tunnel.plist

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/troubleshooting.md (reported line 93)May include surrounding context.

bash
# 重启 OpenClaw 微信插件
launchctl unload ~/Library/LaunchAgents/com.openclaw.wechat-tunnel.plist
launchctl load ~/Library/LaunchAgents/com.openclaw.wechat-tunnel.plist

等价的 graceful 重启：

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script’s help text, status messages, and remediation guidance are entirely in Chinese, including the usage output and all diagnostic results. This is a natural-language locale constraint visible to users, and the file does not offer an opt-in, alternative language, or documented region-specific justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The script's user-facing instructions and prompts are written in Chinese, starting with the introductory comments and continuing throughout the installer. For an all-file policy check, this is a language/locale constraint presented without any opt-in, alternative language path, or explicit justification that the skill is China-specific only.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.