ClawHub
Back to skill

Security audit

微信接龙解析

Security checks for vulnerabilities and agentic risk

Overview

This skill is a focused WeChat group-order parser with a disclosed Tencent Docs export feature, but users should be aware it stores order details online.

Before installing, be comfortable with the skill exporting parsed WeChat order data, including nicknames, room numbers, purchases, and totals, to Tencent Docs when that connector is available. Use it with group data only when participants expect an online spreadsheet, and review the resulting document's access settings before sharing the link.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill instructs the agent to write parsed order data, including nicknames, room numbers, and purchasing details, to Tencent Docs and return a shareable link without requiring explicit user consent or warning about external storage. This can leak personal or sensitive group data to a third-party service and may create unintended persistence, sharing, or access exposure beyond the original chat context.

Static analysis

No suspicious patterns detected.