Security audit

WeCom CCUniverse Leo

Security checks across malware telemetry and agentic risk

Overview

This WeCom document skill is purpose-aligned, but it can route generic document requests to WeCom, use local WeCom/OpenClaw configuration, install a CLI dependency, and overwrite skill-created documents.

Install this only if you want generic document requests to go to WeCom in this environment. Before using it with sensitive business content, verify that mcporter and the configured wecom-doc MCP server are trusted, and remember that edit operations may overwrite the whole document rather than append.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The skill directs the agent to read a local runtime configuration file to auto-discover MCP endpoint details from `~/.openclaw/wecomConfig/config.json`. Even though it is framed as convenience setup, it expands the skill from document operations into local environment inspection and secret/config discovery, which can expose sensitive internal service URLs or configuration data without explicit user consent.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The skill probes environment variables and OpenClaw channel configuration to determine runtime context and retrieve `channels.wecom.botId`, which is unrelated to the core task of editing documents. This kind of host and configuration enumeration increases the agent's access to local operational metadata and can leak internal identifiers or facilitate broader environment reconnaissance.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The activation description is broad enough to trigger on generic document-related requests, increasing the chance the skill is invoked when the user did not intend to use WeCom documents. Over-broad activation can route sensitive content or edit actions to the wrong platform and creates confusion about where data will be created or stored.

Vague Triggers

High

Confidence: 97% confidence
Finding: Defaulting unspecified 'create document' requests to WeCom without platform disambiguation can cause documents to be created or edited in an unintended system, potentially disclosing sensitive content to the wrong workspace or organization. Because this skill also performs write operations, the ambiguity directly affects data placement and access control outcomes.

Missing User Warnings

Medium

Confidence: 80% confidence
Finding: The skill description emphasizes create/write capabilities but does not clearly warn at activation time that document editing is a full overwrite operation. Without an upfront warning, users may request an edit expecting an append or minor modification and unintentionally destroy existing document content.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: Forcing a specific platform for generic document requests removes user choice and can silently redirect content into WeCom without explicit opt-in. In a document-management context, that increases the risk of unauthorized data propagation, policy violations, and accidental writes in the wrong tenant or workspace.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.