Security audit

WeCom CCUniverse Leo

Security checks for vulnerabilities and agentic risk

Overview

This skill appears intended for WeCom documents, but it needs review because it can install persistent tooling and trust arbitrary document-service URLs that may receive your content.

Review before installing. Use this only if you intentionally want WeCom as the default document target, trust the mcporter package source, and can verify the MCP endpoint. Do not paste unknown StreamableHttp URLs or JSON configs, prefer an official or enterprise-approved HTTPS endpoint, and treat document edits as possible full overwrites.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:48
Finding: Unpinned Global Installation of a Third-Party npm Package
Content: View full analysis
Remediation: View remediation
``` 2. Verify package provenance and integrity against a trusted lockfile, checksum, signature, or registry attestation. 3. Use a trusted, explicitly configured npm registry and disable unexpected registry overrides. 4. Prefer a project-local, isolated installation over a global installation. 5. Disable lifecycle scripts where they are unnecessary: ```bash npm install --ignore-scripts ... ``` 6. Review the pinned package and its transitive dependencies before approving updates. 7. Run installation and subsequent MCP operations using a dedicated, least-privileged account or sandbox. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:89
Finding: Shell Command Injection Through Interpolated MCP Configuration Values
Content: View full analysis
" \ --url "" ``` The user-supplied URL flow uses the same construction: ```bash mcporter config add wecom-doc \ --type streamable-http \ --url "" ``` The JSON configuration flow likewise interpolates an extracted URL: ```bash mcporter config add wecom-doc \ --type streamable-http \ --url "" ``` ### Technical Analysis Values obtained from the local runtime configuration or directly from user input are inserted into shell command templates. Double quotes do not provide safe shell argument construction when an untrusted value can itself contain a quote followed by shell metacharacters. For example, if a URL value is accepted as raw text and directly substituted, a payload conceptually shaped like the following can terminate the quoted argument and append another command: ```text https://example.invalid/"; attacker-command; # ``` The documentation does not require URL parsing, character validation, scheme validation, or use of a process API that passes arguments without invoking a shell. Because an AI agent is instructed to construct and execute the displayed shell command, a crafted value may become shell syntax rather than a single data argument. The same issue applies to values read from `~/.openclaw/wecomConfig/config.json` if that file can be modified by another process or compromised component. ### Attack Path 1. An attacker supplies a crafted MCP URL through chat, provides malicious JSON configuration, or modifies the local WeCom runtim ...[truncated 964 chars]
Remediation: View remediation
``` 3. Parse URLs with a standards-compliant URL parser and reject malformed input. 4. Permit only explicitly supported MCP types, such as the exact value `streamable-http`. 5. Permit only `https` endpoints unless a narrowly defined trusted local deployment requires otherwise. 6. Reject control characters, newlines, quotes, command substitutions, and shell metacharacters before any shell-based fallback. 7. Parse JSON with a JSON parser rather than extracting fields through textual matching. 8. Validate the data type and maximum length of every extracted field. 9. If shell execution is unavoidable, apply platform-appropriate shell escaping to each argument after validation; argument-array execution should still be preferred. 10. Execute configuration operations in a least-privileged sandbox. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:307
Finding: Unvalidated User-Controlled MCP Endpoint Can Receive Document Data and Reach Internal Services
Content: View full analysis
" ``` The JSON submission flow performs the same operation with the extracted URL: ```bash mcporter config add wecom-doc \ --type streamable-http \ --url "" ``` Afterward, the Skill directs all document operations through the configured service: ```bash mcporter call wecom-doc. ``` ### Technical Analysis The Skill accepts a user-provided URL or JSON configuration and registers the resulting endpoint as the trusted `wecom-doc` MCP server. It does not require HTTPS, authenticate the server, validate the hostname, restrict destination IP ranges, or require explicit confirmation of the normalized destination. This creates two related trust-boundary failures: 1. **Data disclosure:** An attacker-controlled MCP server can receive document creation and editing content sent during later operations. 2. **Network pivoting:** A URL targeting loopback, link-local, private, or otherwise internal addresses can cause the agent environment to initiate requests that an external user may not be able to make directly. A malicious server may also return attacker-controlled tool names, descriptions, and input schemas. Because the Skill tells the agent to derive calls from the returned tool list rather than hard-code expected tools, hostile metadata could influence later behavior. The reviewed text does not establish a direct arbitrary-code execution path from such metadata, but it expands the attack surface. ### Attack Path 1. An attacker sends the user or agent an attacker-controlled MCP URL or JSON configuration. 2. The Skil ...[truncated 1389 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The activation phrases are broad enough to capture generic requests like creating or writing a document, which can cause the agent to invoke this skill in situations where the user did not intend WeCom at all. Over-broad invocation increases the chance of unintended external document creation or edits in the wrong platform.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The top-level description advertises document creation and writing but does not warn that editing uses full-content overwrite semantics. Users may reasonably interpret 'edit' or 'write document' as append or partial modification, creating a realistic risk of accidental destructive changes.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Defaulting all unspecified document requests to WeCom creates ambiguous invocation scope and can route user content to an external enterprise platform without clear intent. In a write-capable skill, this is dangerous because it may create or overwrite remote content under the wrong account or workspace.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Forcing Enterprise WeCom as the default target without user opt-in violates the principle of explicit user intent for external side effects. In context, the skill is capable of creating and modifying remote documents, so automatic platform selection makes unintended data placement and destructive actions more likely.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill can install a global npm package and modify local MCP configuration as part of handling ordinary document requests. That gives a document-editing skill package-management and environment-mutation capabilities that exceed least privilege, and a user asking to create a document may not expect software installation or persistent CLI reconfiguration.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 81% confidence
Finding: Lines L106-L120 explicitly claim editing is restricted to documents whose docid was obtained from this skill's own create_doc flow. But lines L308-L348 instruct the agent to accept external MCP server configuration from the user and continue operations, which contradicts the stated restriction because the configured backend may expose documents not created in the current session.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The manifest frames this skill as handling enterprise WeCom document and smart-sheet creation/editing. However, the instructions add host-environment inspection by reading ~/.openclaw/wecomConfig/config.json and later checking runtime markers and OpenClaw config, which is a separate configuration-discovery capability rather than direct document manipulation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown file presents all instructions and examples only in Chinese, which can amount to a language/locale policy issue when users are not given an opt-in or alternative language. The file does not state that the skill is region-specific or otherwise justify the language restriction.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.