Wechat Forward

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:15 AM UTC
• Version: 1.0.1

Overview

The skill is mostly coherent, but its command examples can be unsafe if message text or file paths are pasted into a shell.

Review this before installing if the agent will forward untrusted or copied content. Use only on explicit requests, verify the WeChat destination, and ensure wxclawbot is invoked with safe argument handling rather than pasting raw message text or file paths into a shell command.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:70

Finding

Potential Shell Command Injection Through Unescaped Message Content and File Paths

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 70–73 and 78–81
Vulnerability Type: Shell command injection caused by unsafe command construction guidance
Risk Level: High

Vulnerable code snippets:

bash

wxclawbot send --text "消息内容" --json

bash

wxclawbot send --file /path/to/file --text "说明" --json

Technical Analysis

The Skill instructs the Agent to insert conversation content, descriptive text, and file paths into shell command templates. It does not require execution through a shell-free argument array, define robust escaping rules, or validate the supplied file path.

If an implementation constructs these commands by directly replacing the placeholders and then passes the resulting string to a shell, attacker-controlled values can terminate the intended quoting context or introduce command substitutions and other shell metacharacters. Payloads containing constructs such as double quotes, $(...), backticks, semicolons, pipes, or redirections could consequently be interpreted by the shell rather than treated exclusively as wxclawbot arguments.

The file-forwarding form introduces an additional injection surface because both the file path and accompanying text can be influenced by input. The issue is conditional on a shell-based implementation performing direct interpolation; execution through a subprocess argument array without a shell would prevent shell metacharacter interpretation.

Attack Path

1. An attacker causes crafted text or a crafted file path containing shell syntax to appear in the conversation.
2. The user explicitly asks the Agent to forward that content or file to WeChat.
3. The Agent follows the documented template and interpolates the untrusted value into a command string.
4. A shell-based executor parses the interpolated value as shell syntax.
5. The injected command executes before, after, or instead of the intended wxclawbot send operation.

...[truncated 474 chars]

Remediation

View remediation

Remediation Suggestions

• Invoke wxclawbot directly through a subprocess API that accepts an argument array, with shell processing disabled. For example, pass arguments equivalent to ["wxclawbot", "send", "--text", message, "--json"].
• Never build a shell command by concatenating or interpolating conversation content, descriptive text, or file paths.
• Update the Skill instructions to explicitly prohibit shell evaluation mechanisms such as sh -c, bash -c, eval, or equivalent command-string execution.
• If a shell is unavoidable, apply platform-specific argument escaping to every untrusted value and reject control characters. Escaping is a fallback and should not replace shell-free execution.
• Normalize file paths, require explicit user approval for the selected file, and restrict forwarding to approved directories where practical.
• Treat message content and filenames solely as opaque data, including when they contain quotes, substitutions, newlines, redirections, or option-like prefixes.
• Add tests using adversarial inputs such as quotes, command substitutions, semicolons, pipes, newlines, and filenames beginning with hyphens to confirm that no input is interpreted as executable syntax.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep