Security audit

wechat-mp-publisher

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent WeChat publishing helper, but it handles unpublished articles and WeChat secrets through remote and shell-based flows that are not safely scoped or clearly protected.

Review this before installing. Use it only with an MCP server you control or fully trust, require HTTPS rather than the documented HTTP example, and assume the remote service can see unpublished articles and WeChat AppID/AppSecret. Avoid the legacy TOOLS.md setup, protect wechat.env with restrictive permissions, do not put shell commands in it, prefer a pinned/preinstalled publishing CLI over npx, and test with a low-risk account or draft workflow before using production credentials.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/publish-remote.sh:96
Finding: WeChat credentials and unpublished content may be transmitted over plaintext HTTP
Content: View full analysis
/dev/null) ``` The documented MCP configuration explicitly recommends an unencrypted HTTP endpoint: ```json { "mcpServers": { "wenyan-mcp": { "name": "Remote WeChat Assistant", "transport": "sse", "url": "http://:3000/sse", "headers": { "X-API-Key": "" } } } } ``` ### Technical Analysis The remote publishing script places the WeChat AppID and AppSecret directly into the arguments sent to `wenyan-mcp.publish_article`. It also uploads the unpublished Markdown article through the same configurable MCP service. Remote processing is part of the declared functionality, so transmitting publishing data to a remote server is functionally expected. However, transmitting it over plaintext HTTP is not necessary. The script does not reject non-TLS endpoints or otherwise enforce transport security. The MCP endpoint is selected through `$HOME/.openclaw/mcp.json` or a user-specified configuration file. Consequently, the confidentiality of the credentials and article depends entirely on the selected endpoint and network path. ### Attack Path 1. A user follows the configuration example and sets the MCP URL to an `http://` endpoint. 2. The user invokes `scripts/publish-remote.s ...[truncated 969 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/setup.sh:5
Finding: Legacy setup script reads credentials from the general OpenClaw workspace
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: scripts/publish.sh:26
Finding: Unpinned publishing package may be downloaded and executed at runtime through npx
Content: View full analysis
/dev/null; then echo -e "${YELLOW}wenyan-cli is not installed; running it with npx...${NC}" WENYAN_CMD="npx @wenyan-md/cli" else echo -e "${RED}wenyan-cli and npx are not installed.${NC}" echo -e "${YELLOW}Install Node.js or run: npm install -g @wenyan-md/cli${NC}" exit 1 fi ``` The selected command is later executed as follows at `scripts/publish.sh:85`: ```bash $WENYAN_CMD publish -f "$file" -t "$theme" -h "$highlight" ``` ### Technical Analysis When a local `wenyan` executable is unavailable, the script falls back to `npx @wenyan-md/cli` without specifying an exact package version or verifying package integrity. This means the code executed during publication can differ from the code reviewed with the Skill. The effective dependency is resolved from the configured npm registry at runtime. A compromised package release, registry account, registry mirror, or local npm configuration could cause attacker-controlled package code to run. The package executes while WeChat credentials are exported in the environment and while the article path is available. Therefore, a compromised dependency would have access to high-value publishing data. ### Attack Path 1. The victim's system does not have the `wenyan` command installed. 2. The script detects `npx` and selects `npx @wenyan-md/cli`. 3. `check_env` loads and exports `WECHAT_APP_ID` and `WECHAT_APP_SECRET`. 4. The publication function invokes the unpinned package through `npx`. 5. A malicious or compromised package version executes with the victim's user privileges. 6. The package reads inherited credentials, article files, or other user-accessible resources and may transmit or misuse them. ### Impact Assessment A compromised dependency would execute with the privileges of t ...[truncated 480 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/publish-remote.sh:15
Finding: Credential configuration file is executed as arbitrary shell code
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: A second material mismatch exists around undeclared credential/data handling: the skill presents itself as a remote publishing helper but does not clearly disclose all local/remote behaviors, while static analysis indicates possible access to local credential material not transparently described to the user. In a publishing skill that may process article drafts and account secrets, hidden or overstated behavior materially increases the risk of credential leakage and unintended data transmission.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: A second material mismatch exists around undeclared credential/data handling: the skill presents itself as a remote publishing helper but does not clearly disclose all local/remote behaviors, while static analysis indicates possible access to local credential material not transparently described to the user. In a publishing skill that may process article drafts and account secrets, hidden or overstated behavior materially increases the risk of credential leakage and unintended data transmission.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/troubleshooting.md (reported line 8)May include surrounding context.
md
使用本远程技能时，**必须将 MCP 服务所在公网 IP** 加入白名单，而**不是**你当前操作机器的 IP。 **为什么？** - 所有的 API 请求（包括获取 Access Token、上传图文、上传素材）都是由 **远程 MCP 服务器** 发起的。 - 你本地的 OpenClaw 只负责发指令给 MCP，不直接与微信交互。 - 即使你在家里用动态 IP 也没关系，只要 MCP 服务器 IP 固定即可。

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README promotes remote HTTP publishing and emphasizes convenience and 'security isolation', but it does not clearly disclose that article content and sensitive runtime credentials are sent to a remote MCP service. This can mislead users into trusting the setup as local-only or low-risk, increasing the chance of credential exposure, content leakage, or publication through an untrusted intermediary.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill advertises shell-based setup and execution steps (cp, nano, chmod, running a publish script) but does not declare any explicit tool scope or allowed-tools boundary. That omission weakens least-privilege controls and can cause an agent to invoke shell capabilities more broadly than users expect, increasing the chance of unintended local command execution.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill promotes use of a remote HTTP MCP service but does not prominently warn that article content, metadata, and possibly operational context will be transmitted to a remote server. This is a meaningful security and privacy issue because users may send unpublished drafts or sensitive business content off-device without informed consent, especially since the example uses plain HTTP rather than HTTPS.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The suggested invocation phrase is broad ('帮我把 path/to/article.md 发布到公众号...') and lacks clear activation constraints, confirmations, or boundary checks. In practice this can cause the agent to trigger the skill for ambiguous requests and perform publication actions against local files or remote services without sufficient user intent verification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The example content encourages credential setup and one-click publication to a real WeChat public account but does not warn that content and media will be transmitted to a remote service and may immediately affect a live account. In a publishing skill, this omission increases the chance of accidental posting, unintended data disclosure, or misuse by users who treat the example as harmless test content.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The file presents all troubleshooting guidance exclusively in Chinese, which can constitute a language/locale policy issue when no user opt-in or justification is provided. The content does not indicate that the skill is region-specific or that alternative language support is available.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script reads the full article content and sends it to a remote MCP service, then sends WeChat App ID and App Secret to the same remote service for publishing. Even if this is functionally intended, it creates a real confidentiality risk because sensitive content and credentials are disclosed to an external system without an explicit runtime warning, consent step, or clear trust boundary enforcement.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The script dynamically executes an external package through npx, which means unreviewed remote code can run at publish time. Although invoking a publishing CLI is aligned with the skill's purpose, the dynamic download/execution model expands trust to the npm supply chain and allows that package to access article content, environment variables, and the local system.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The script falls back to executing npx @wenyan-md/cli without pinning a specific version, so each run may fetch and execute whatever package version is currently published. This creates a supply-chain risk: a compromised upstream package, typo-squatted dependency resolution, or unexpected breaking change could lead to arbitrary code execution in the user's environment with access to WeChat credentials and local files.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The script description is written only in Chinese ("远程发布文章到微信公众号"), which imposes a specific language context without offering any user choice or bilingual explanation. Under the stated policy, forcing a language or locale without opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The inline comment says credentials are sourced 'only specific vars to avoid polluting env', suggesting a constrained handling approach. In practice, the script exports both secrets as environment variables for downstream commands, which still populates the process environment and weakens the stated isolation intent.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.