Wecom Deep Op

• Outcome: Review
• Latest audit: Sep 14, 2026 · 10:13 PM UTC
• Version: 2.0.2

Overview

This is a coherent WeCom automation skill, but it needs Review because sensitive business data can be sent to any configured endpoint and full operation payloads can be logged in debug mode.

Review this before installing in a real enterprise workspace. Use a least-privilege WeCom bot, keep uaKeys out of source control, restrict WECOM_*_BASE_URL values to trusted HTTPS WeCom endpoints or an approved internal proxy, and do not enable DEBUG_LEVEL=debug when handling real business data. Expect the skill to modify or delete WeCom data within the bot's granted permissions.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: src/index.ts:247

Finding

Unrestricted MCP Endpoint Configuration Permits Sensitive Data Exfiltration

Content

View full analysis

= {}, logger?: Logger ): Promise> { const baseUrl = getServiceUrl(service); const url = `${baseUrl}/${tool}`; const makeRequest = async () => { logger?.debug(`${service}.${tool}`, params); const response = await fetch(url, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(params) }); const data = (await response.json()) as any; ``` ### Technical Analysis The Skill obtains each MCP destination from an environment variable and uses it directly as the base of an outbound `fetch` request. It does not parse or validate the URL before use. In particular, it does not: - Require HTTPS. - Restrict the hostname to the documented WeCom API host, `qyapi.weixin.qq.com`. - Reject embedded URL credentials. - Reject unexpected ports. - Validate that the configured path belongs to the expected WeCom MCP service. - Prevent redirection to another origin. The documented URL format embeds the sensitive WeCom `uaKey` in the query string. The request body can contain enterprise ...[truncated 2375 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: src/index.ts:52

Finding

Debug Logging Discloses Sensitive Enterprise Operation Payloads

Content

View full analysis

{ logger?.debug(`${service}.${tool}`, params); const response = await fetch(url, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(params) }); ``` ### Technical Analysis When `DEBUG_LEVEL=debug`, the shared API request function writes the complete `params` object to standard output. Depending on the invoked tool, this object can contain: - Full document content. - Calendar summaries, locations, descriptions, and attendees. - Meeting subjects, agendas, and attendee identifiers. - Todo titles, descriptions, creators, and recipients. - Document, schedule, meeting, and todo identifiers. Although the endpoint URL and `uaKey` are not directly logged by this statement, the business payload itself can be confidential. Standard output is commonly retained by container runtimes, CI systems, process supervisors, cloud logging agents, and centralized observability platforms. The issue therefore creates a secondary, potentially long-lived copy of enterprise data outside WeCom. This behavior also conflicts with the Skill documentation's claim that concrete business data is not recorded. ### Attack Path 1. Debug logging is ...[truncated 1264 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (89)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · CLAWHUB_PUBLISHING.md (reported line 45)May include surrounding context.

检查是否有硬编码的 token/secret

grep -r "token|secret|password" . --exclude-dir=node_modules --exclude="*.json" | grep -v "YOUR_"

检查是否有 mcporter.json 或 .env

ls -la .env mcporter.json secrets.json 2>/dev/null || echo "No sensitive files found"

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · CLAWHUB_PUBLISHING.md (reported line 46)May include surrounding context.

检查是否有硬编码的 token/secret

grep -r "token|secret|password" . --exclude-dir=node_modules --exclude="*.json" | grep -v "YOUR_"

检查是否有 mcporter.json 或 .env

ls -la .env mcporter.json secrets.json 2>/dev/null || echo "No sensitive files found"

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · CLAWHUB_PUBLISHING.md (reported line 86)May include surrounding context.

检查是否有硬编码的 token/secret

grep -r "token|secret|password" . --exclude-dir=node_modules --exclude="*.json" | grep -v "YOUR_"

检查是否有 mcporter.json 或 .env

ls -la .env mcporter.json secrets.json 2>/dev/null || echo "No sensitive files found"

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · PUBLISHING.md (reported line 182)May include surrounding context.

检查是否有硬编码的 token/secret

grep -r "token|secret|password" . --exclude-dir=node_modules --exclude="*.json" | grep -v "YOUR_"

检查是否有 mcporter.json 或 .env

ls -la .env mcporter.json secrets.json 2>/dev/null || echo "No sensitive files found"

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 539)May include surrounding context.

检查是否有硬编码的 token/secret

grep -r "token|secret|password" . --exclude-dir=node_modules --exclude="*.json" | grep -v "YOUR_"

检查是否有 mcporter.json 或 .env

ls -la .env mcporter.json secrets.json 2>/dev/null || echo "No sensitive files found"

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 546)May include surrounding context.

检查是否有硬编码的 token/secret

grep -r "token|secret|password" . --exclude-dir=node_modules --exclude="*.json" | grep -v "YOUR_"

检查是否有 mcporter.json 或 .env

ls -la .env mcporter.json secrets.json 2>/dev/null || echo "No sensitive files found"

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SECURITY_AUDIT.md (reported line 61)May include surrounding context.

检查是否有硬编码的 token/secret

grep -r "token|secret|password" . --exclude-dir=node_modules --exclude="*.json" | grep -v "YOUR_"

检查是否有 mcporter.json 或 .env

ls -la .env mcporter.json secrets.json 2>/dev/null || echo "No sensitive files found"

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · CLAWHUB_PUBLISHING.md (reported line 46)May include surrounding context.

grep -r "token|secret|password" . --exclude-dir=node_modules --exclude="*.json" | grep -v "YOUR_"

检查是否有 mcporter.json 或 .env

ls -la .env mcporter.json secrets.json 2>/dev/null || echo "No sensitive files found"

text

**如果发现问题，立即删除或替换为占位符！**

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · CLAWHUB_PUBLISHING.md (reported line 77)May include surrounding context.

grep -r "token|secret|password" . --exclude-dir=node_modules --exclude="*.json" | grep -v "YOUR_"

检查是否有 mcporter.json 或 .env

ls -la .env mcporter.json secrets.json 2>/dev/null || echo "No sensitive files found"

text

**如果发现问题，立即删除或替换为占位符！**

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · CLAWHUB_PUBLISHING.md (reported line 90)May include surrounding context.

grep -r "token|secret|password" . --exclude-dir=node_modules --exclude="*.json" | grep -v "YOUR_"

检查是否有 mcporter.json 或 .env

ls -la .env mcporter.json secrets.json 2>/dev/null || echo "No sensitive files found"

text

**如果发现问题，立即删除或替换为占位符！**

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · GITHUB_REPOSITORY.md (reported line 145)May include surrounding context.

grep -r "token|secret|password" . --exclude-dir=node_modules --exclude="*.json" | grep -v "YOUR_"

检查是否有 mcporter.json 或 .env

ls -la .env mcporter.json secrets.json 2>/dev/null || echo "No sensitive files found"

text

**如果发现问题，立即删除或替换为占位符！**

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · PREPARATION_CHECKLIST.md (reported line 57)May include surrounding context.

grep -r "token|secret|password" . --exclude-dir=node_modules --exclude="*.json" | grep -v "YOUR_"

检查是否有 mcporter.json 或 .env

ls -la .env mcporter.json secrets.json 2>/dev/null || echo "No sensitive files found"

text

**如果发现问题，立即删除或替换为占位符！**

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · PUBLISHING.md (reported line 186)May include surrounding context.

grep -r "token|secret|password" . --exclude-dir=node_modules --exclude="*.json" | grep -v "YOUR_"

检查是否有 mcporter.json 或 .env

ls -la .env mcporter.json secrets.json 2>/dev/null || echo "No sensitive files found"

text

**如果发现问题，立即删除或替换为占位符！**

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 542)May include surrounding context.

grep -r "token|secret|password" . --exclude-dir=node_modules --exclude="*.json" | grep -v "YOUR_"

检查是否有 mcporter.json 或 .env

ls -la .env mcporter.json secrets.json 2>/dev/null || echo "No sensitive files found"

text

**如果发现问题，立即删除或替换为占位符！**

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SECURITY_AUDIT.md (reported line 55)May include surrounding context.

grep -r "token|secret|password" . --exclude-dir=node_modules --exclude="*.json" | grep -v "YOUR_"

检查是否有 mcporter.json 或 .env

ls -la .env mcporter.json secrets.json 2>/dev/null || echo "No sensitive files found"

text

**如果发现问题，立即删除或替换为占位符！**

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SECURITY_AUDIT.md (reported line 64)May include surrounding context.

grep -r "token|secret|password" . --exclude-dir=node_modules --exclude="*.json" | grep -v "YOUR_"

检查是否有 mcporter.json 或 .env

ls -la .env mcporter.json secrets.json 2>/dev/null || echo "No sensitive files found"

text

**如果发现问题，立即删除或替换为占位符！**

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SECURITY_AUDIT.md (reported line 76)May include surrounding context.

grep -r "token|secret|password" . --exclude-dir=node_modules --exclude="*.json" | grep -v "YOUR_"

检查是否有 mcporter.json 或 .env

ls -la .env mcporter.json secrets.json 2>/dev/null || echo "No sensitive files found"

text

**如果发现问题，立即删除或替换为占位符！**

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 640)May include surrounding context.

md

- ✅ 读取的文件内容仅用于本次请求，不缓存、不记录

**风险场景（非本 Skill 行为）**:
- ❌ 如果用户提供 `/etc/passwd` 路径，Skill 会读取该文件内容（但这是用户主动行为）
- ❌ 如果用户配置了恶意 `WECOM_DOC_BASE_URL`，数据将被发送到攻击者服务器（但这是用户配置错误）

**审计建议**:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · REMOTE_SETUP.md (reported line 44)May include surrounding context.

md

**注意**:
- 如果 `master` 分支不存在，使用 `main` 或 `git push -u origin HEAD`
- 如果是 HTTPS URL，Git 会提示输入 GitHub 用户名和密码（密码改为 Personal Access Token）
- 推荐使用 SSH（需提前配置 SSH 密钥）

### Step 3: 验证

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · REMOTE_SETUP.md (reported line 116)May include surrounding context.

md

**注意**:
- 如果 `master` 分支不存在，使用 `main` 或 `git push -u origin HEAD`
- 如果是 HTTPS URL，Git 会提示输入 GitHub 用户名和密码（密码改为 Personal Access Token）
- 推荐使用 SSH（需提前配置 SSH 密钥）

### Step 3: 验证

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · PUBLISHING.md (reported line 187)May include surrounding context.

md

**发布包文件列表** (23个):
- 仅包含 skill 本身的代码和文档
- 无任何 `.env`, `mcporter.json`, `secrets.json`, `credentials.json`

### 5. .gitignore 和 .clawhubignore

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 543)May include surrounding context.

md

**发布包文件列表** (23个):
- 仅包含 skill 本身的代码和文档
- 无任何 `.env`, `mcporter.json`, `secrets.json`, `credentials.json`

### 5. .gitignore 和 .clawhubignore

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SECURITY_AUDIT.md (reported line 55)May include surrounding context.

md

**发布包文件列表** (23个):
- 仅包含 skill 本身的代码和文档
- 无任何 `.env`, `mcporter.json`, `secrets.json`, `credentials.json`

### 5. .gitignore 和 .clawhubignore

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SECURITY_AUDIT.md (reported line 65)May include surrounding context.

md

**发布包文件列表** (23个):
- 仅包含 skill 本身的代码和文档
- 无任何 `.env`, `mcporter.json`, `secrets.json`, `credentials.json`

### 5. .gitignore 和 .clawhubignore

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SECURITY_AUDIT.md (reported line 77)May include surrounding context.

md

**发布包文件列表** (23个):
- 仅包含 skill 本身的代码和文档
- 无任何 `.env`, `mcporter.json`, `secrets.json`, `credentials.json`

### 5. .gitignore 和 .clawhubignore

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: dist/index.cjs.js:44

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: dist/index.esm.js:40

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: src/index.ts:52