WeCom CCUniverse Leo

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:45 AM UTC
• Version: 1.0.0

Overview

This skill appears intended for WeCom documents, but it needs review because it can install persistent tooling and trust arbitrary document-service URLs that may receive your content.

Review before installing. Use this only if you intentionally want WeCom as the default document target, trust the mcporter package source, and can verify the MCP endpoint. Do not paste unknown StreamableHttp URLs or JSON configs, prefer an official or enterprise-approved HTTPS endpoint, and treat document edits as possible full overwrites.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:48
• Finding: Unpinned Global Installation of a Third-Party npm Package<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 48-55 **Vulnerability Type**: Unpinned third-party dependency installed globally **Risk Level**: Medium ### Vulnerable Code ```bash npm install -g mcporter ``` ### Technical Analysis The Skill instructs the agent to install `mcporter` globally from the configured npm registry without specifying a version or verifying package integrity. Consequently, the installed code depends on whichever package version and package contents the registry serves at execution time. A malicious or compromised future package release, registry account, registry mirror, or dependency in the package's transitive dependency tree could introduce arbitrary code. npm packages may also execute lifecycle scripts during installation. The global installation scope makes the package available beyond the current Skill invocation. This is an unsafe supply-chain practice even though the reviewed project does not itself contain a malicious script. ### Attack Path 1. An attacker compromises the `mcporter` package, one of its dependencies, its publisher account, or the npm registry path used by the system. 2. The attacker publishes or causes delivery of a malicious version. 3. A user invokes the Skill on a system where `mcporter` is absent. 4. The Skill asks for installation approval. 5. After approval, the agent runs `npm install -g mcporter` without a version or integrity constraint. 6. Malicious package code or an npm lifecycle script executes with the privileges of the user running npm. 7. The globally installed command remains available to later sessions and can affect subsequent MCP operations. ### Impact Assessment Successful exploitation permits package installation-time code to execute with the operating-system privileges of the invoking user. This may expose files, environment variables, OpenClaw configuration, and credentials accessible to that user. It may also alter globally installed tooling and affect fut ...[truncated 196 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `mcporter` to a specifically reviewed version, for example: ```bash npm install --global mcporter@<AUDITED_VERSION> ``` 2. Verify package provenance and integrity against a trusted lockfile, checksum, signature, or registry attestation. 3. Use a trusted, explicitly configured npm registry and disable unexpected registry overrides. 4. Prefer a project-local, isolated installation over a global installation. 5. Disable lifecycle scripts where they are unnecessary: ```bash npm install --ignore-scripts ... ``` 6. Review the pinned package and its transitive dependencies before approving updates. 7. Run installation and subsequent MCP operations using a dedicated, least-privileged account or sandbox. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:89
• Finding: Shell Command Injection Through Interpolated MCP Configuration Values<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 89-92; additional affected flows at lines 315-318 and 337-340 **Vulnerability Type**: Shell command injection **Risk Level**: High ### Vulnerable Code The following is the complete affected command pattern, with the original natural-language placeholders represented in English: ```bash mcporter config add wecom-doc \ --type "<VALUE_FROM_MCP_CONFIG_DOC_TYPE>" \ --url "<VALUE_FROM_MCP_CONFIG_DOC_URL>" ``` The user-supplied URL flow uses the same construction: ```bash mcporter config add wecom-doc \ --type streamable-http \ --url "<USER_PROVIDED_URL>" ``` The JSON configuration flow likewise interpolates an extracted URL: ```bash mcporter config add wecom-doc \ --type streamable-http \ --url "<URL_EXTRACTED_FROM_JSON>" ``` ### Technical Analysis Values obtained from the local runtime configuration or directly from user input are inserted into shell command templates. Double quotes do not provide safe shell argument construction when an untrusted value can itself contain a quote followed by shell metacharacters. For example, if a URL value is accepted as raw text and directly substituted, a payload conceptually shaped like the following can terminate the quoted argument and append another command: ```text https://example.invalid/"; attacker-command; # ``` The documentation does not require URL parsing, character validation, scheme validation, or use of a process API that passes arguments without invoking a shell. Because an AI agent is instructed to construct and execute the displayed shell command, a crafted value may become shell syntax rather than a single data argument. The same issue applies to values read from `~/.openclaw/wecomConfig/config.json` if that file can be modified by another process or compromised component. ### Attack Path 1. An attacker supplies a crafted MCP URL through chat, provides malicious JSON configuration, or modifies the local WeCom runtim ...[truncated 964 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not construct a shell command by interpolating configuration or user input. 2. Invoke `mcporter` through an execution interface that accepts a program and argument array: ```text executable: mcporter arguments: - config - add - wecom-doc - --type - streamable-http - --url - <validated URL> ``` 3. Parse URLs with a standards-compliant URL parser and reject malformed input. 4. Permit only explicitly supported MCP types, such as the exact value `streamable-http`. 5. Permit only `https` endpoints unless a narrowly defined trusted local deployment requires otherwise. 6. Reject control characters, newlines, quotes, command substitutions, and shell metacharacters before any shell-based fallback. 7. Parse JSON with a JSON parser rather than extracting fields through textual matching. 8. Validate the data type and maximum length of every extracted field. 9. If shell execution is unavoidable, apply platform-appropriate shell escaping to each argument after validation; argument-array execution should still be preferred. 10. Execute configuration operations in a least-privileged sandbox. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:307
• Finding: Unvalidated User-Controlled MCP Endpoint Can Receive Document Data and Reach Internal Services<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 307-340 **Vulnerability Type**: Untrusted endpoint configuration, data disclosure, and server-side request forgery exposure **Risk Level**: High ### Vulnerable Code The URL submission flow configures any user-provided URL as the `wecom-doc` service: ```bash mcporter config add wecom-doc \ --type streamable-http \ --url "<USER_PROVIDED_URL>" ``` The JSON submission flow performs the same operation with the extracted URL: ```bash mcporter config add wecom-doc \ --type streamable-http \ --url "<URL_EXTRACTED_FROM_JSON>" ``` Afterward, the Skill directs all document operations through the configured service: ```bash mcporter call wecom-doc.<tool> ``` ### Technical Analysis The Skill accepts a user-provided URL or JSON configuration and registers the resulting endpoint as the trusted `wecom-doc` MCP server. It does not require HTTPS, authenticate the server, validate the hostname, restrict destination IP ranges, or require explicit confirmation of the normalized destination. This creates two related trust-boundary failures: 1. **Data disclosure:** An attacker-controlled MCP server can receive document creation and editing content sent during later operations. 2. **Network pivoting:** A URL targeting loopback, link-local, private, or otherwise internal addresses can cause the agent environment to initiate requests that an external user may not be able to make directly. A malicious server may also return attacker-controlled tool names, descriptions, and input schemas. Because the Skill tells the agent to derive calls from the returned tool list rather than hard-code expected tools, hostile metadata could influence later behavior. The reviewed text does not establish a direct arbitrary-code execution path from such metadata, but it expands the attack surface. ### Attack Path 1. An attacker sends the user or agent an attacker-controlled MCP URL or JSON configuration. 2. The Skil ...[truncated 1389 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Allow only official, documented WeCom MCP domains or a tightly controlled enterprise allowlist. 2. Require HTTPS and reject plaintext HTTP. 3. Resolve the hostname and reject loopback, link-local, private, multicast, unspecified, and reserved address ranges unless explicitly authorized. 4. Revalidate the resolved address after redirects and reject redirects to disallowed destinations. 5. Protect against DNS rebinding by validating all resolved addresses and binding validation to the actual connection. 6. Normalize and display the final scheme, hostname, port, and path before configuration, then require explicit user confirmation. 7. Authenticate the MCP server using certificates, signed configuration, or another organization-approved trust mechanism. 8. Do not treat arbitrary chat content containing a URL as sufficient authorization to modify a persistent MCP configuration. 9. Store endpoint configuration with restricted file permissions and record auditable configuration changes. 10. Validate returned tool metadata against an allowlist of expected document operations and schemas. 11. Apply outbound network controls so the MCP client cannot access cloud metadata endpoints or unrelated internal services. 12. Warn users before transmitting document content to a newly configured endpoint. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The activation phrases are broad enough to capture generic requests like creating or writing a document, which can cause the agent to invoke this skill in situations where the user did not intend WeCom at all. Over-broad invocation increases the chance of unintended external document creation or edits in the wrong platform.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The top-level description advertises document creation and writing but does not warn that editing uses full-content overwrite semantics. Users may reasonably interpret 'edit' or 'write document' as append or partial modification, creating a realistic risk of accidental destructive changes.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: Defaulting all unspecified document requests to WeCom creates ambiguous invocation scope and can route user content to an external enterprise platform without clear intent. In a write-capable skill, this is dangerous because it may create or overwrite remote content under the wrong account or workspace.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: Forcing Enterprise WeCom as the default target without user opt-in violates the principle of explicit user intent for external side effects. In context, the skill is capable of creating and modifying remote documents, so automatic platform selection makes unintended data placement and destructive actions more likely.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The skill can install a global npm package and modify local MCP configuration as part of handling ordinary document requests. That gives a document-editing skill package-management and environment-mutation capabilities that exceed least privilege, and a user asking to create a document may not expect software installation or persistent CLI reconfiguration.

Intent-Code Divergence

Medium

• Confidence: 81% confidence
• Finding: Lines L106-L120 explicitly claim editing is restricted to documents whose `docid` was obtained from this skill's own `create_doc` flow. But lines L308-L348 instruct the agent to accept external MCP server configuration from the user and continue operations, which contradicts the stated restriction because the configured backend may expose documents not created in the current session.

Context-Inappropriate Capability

Low

• Confidence: 79% confidence
• Finding: The manifest frames this skill as handling enterprise WeCom document and smart-sheet creation/editing. However, the instructions add host-environment inspection by reading `~/.openclaw/wecomConfig/config.json` and later checking runtime markers and OpenClaw config, which is a separate configuration-discovery capability rather than direct document manipulation.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: This markdown file presents all instructions and examples only in Chinese, which can amount to a language/locale policy issue when users are not given an opt-in or alternative language. The file does not state that the skill is region-specific or otherwise justify the language restriction.

Static analysis

No suspicious patterns detected.