Wechat Mp Toolkit

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:34 AM UTC
• Version: 1.0.0

Overview

This WeChat publishing skill mostly does what it says, but it ships real-looking WeChat credentials and runs publishing automation with under-scoped safeguards.

Review this carefully before installing. Do not run it with the bundled credentials, rotate them if they belong to you, replace them with environment-provided secrets, and avoid the one-click publish workflow until it has a dry-run or confirmation step and the external cover-generator execution is removed or integrity-checked.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/full-workflow.js:13
• Finding: Hard-Coded WeChat Application Credentials<![CDATA[ ## Vulnerability Details **File Locations**: - `scripts/full-workflow.js:13-19` - `scripts/publish-existing.js:12-17` - `config/config.json:2-5` **Vulnerability Type**: Hard-coded secret and plaintext credential exposure **Risk Level**: High ### Vulnerable Code `scripts/full-workflow.js:13-19` ```javascript const config = { appID: 'wx128409576294cb9d', appSecret: '3139a3d2a930678209d8ffae5e103005', apiBase: 'https://api.weixin.qq.com', outputDir: '/root/.openclaw/wechat-publish', skillDir: '/root/.openclaw/workspace/skills/wechat-mp-toolkit' }; ``` `scripts/publish-existing.js:12-17` ```javascript const config = { appID: 'wx128409576294cb9d', appSecret: '3139a3d2a930678209d8ffae5e103005', apiBase: 'https://api.weixin.qq.com' }; ``` `config/config.json:2-5` ```json "wechat": { "appID": "wx128409576294cb9d", "appSecret": "3139a3d2a930678209d8ffae5e103005", "apiBase": "https://api.weixin.qq.com" } ``` The credentials are transmitted at `scripts/full-workflow.js:210-211`: ```javascript const tokenUrl = `${config.apiBase}/cgi-bin/token?grant_type=client_credential&appid=${config.appID}&secret=${config.appSecret}`; const tokenResponse = await axios.get(tokenUrl); ``` The same transmission occurs at `scripts/publish-existing.js:39-40`: ```javascript const tokenUrl = `${config.apiBase}/cgi-bin/token?grant_type=client_credential&appid=${config.appID}&secret=${config.appSecret}`; const tokenResponse = await axios.get(tokenUrl, { timeout: 10000 }); ``` ### Technical Analysis A concrete WeChat App ID and App Secret are embedded directly in two executable scripts and one tracked configuration file. Anyone who can obtain the Skill archive, repository, an installed copy, or retained repository history can recover the secret without executing the code. The scripts use the credential to request an access token from the official WeChat API. Sending the credential to that endpoint is necessary for the declared publishing function and do ...[truncated 1686 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Immediately revoke and rotate the exposed WeChat App Secret. 2. Review WeChat API activity for unauthorized token requests, media uploads, or draft operations. 3. Remove the credential from both scripts and `config/config.json`. 4. Purge the exposed secret from repository history and invalidate all archived copies where feasible. 5. Load credentials at runtime from protected environment variables or an operating-system secret manager. For example: ```javascript const config = { appID: process.env.WECHAT_APP_ID, appSecret: process.env.WECHAT_APP_SECRET, apiBase: 'https://api.weixin.qq.com' }; if (!config.appID || !config.appSecret) { throw new Error('WECHAT_APP_ID and WECHAT_APP_SECRET are required'); } ``` 6. Commit only a sanitized example file such as `config/config.example.json`, and exclude the real credential file through `.gitignore`. 7. Restrict secret-file permissions to the account that runs the Skill. 8. Prevent secrets and access tokens from being written to application logs, exception output, telemetry, or diagnostics. 9. Apply WeChat-side least-privilege controls, including IP allowlisting and the minimum API permissions required for draft publishing. 10. Add automated secret scanning to development and release workflows. ]]>

T07 · Tool Hijacking and Spoofing

Warning

• Location: scripts/full-workflow.js:162
• Finding: Execution of Mutable Code Outside the Audited Skill Boundary<![CDATA[ ## Vulnerability Details **File Location**: `scripts/full-workflow.js:162-166` **Vulnerability Type**: Untrusted external tool execution **Risk Level**: Medium ### Vulnerable Code ```javascript const coverScript = '/root/.openclaw/workspace-operator/skills/wechat-cover-generator/simple-minimal-cover.js'; if (fs.existsSync(coverScript)) { try { execSync(`node ${coverScript}`, { stdio: 'inherit' }); ``` ### Technical Analysis The recommended full workflow conditionally executes a JavaScript file located outside the project directory. That external file is not included in the audited artifact, so its contents, provenance, update behavior, and permissions cannot be verified as part of this Skill. The path is fixed, but `fs.existsSync()` only confirms that an object exists at the location; it does not verify ownership, file type, integrity, or trusted provenance. The code then invokes the file through a shell-backed `execSync()` call. Consequently, the effective behavior of the audited workflow can change independently of this Skill whenever the external file is created or modified. This execution exceeds the minimum behavior required for cover generation because the same function already includes a local fallback based on SVG and ImageMagick. It therefore introduces an avoidable trust relationship with another mutable Skill or workspace. The fixed command currently contains no user-controlled interpolation, so no direct command-injection path was confirmed from this statement alone. The primary risk is arbitrary code execution through replacement or modification of the external JavaScript file. ### Attack Path 1. An attacker or compromised component obtains write access to: `/root/.openclaw/workspace-operator/skills/wechat-cover-generator/simple-minimal-cover.js` or to a parent directory that permits replacement. 2. The attacker creates or modifies that file to contain malicious JavaScript. 3. A user follows the documented recommendat ...[truncated 1101 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the external execution path and use the existing local cover-generation implementation when possible. 2. If a specialized generator is required, bundle its source inside this project so that it is versioned and audited with the Skill. 3. Require explicit user opt-in before invoking code from another workspace or Skill. 4. Pin and verify the external file with a cryptographic hash or signed manifest before every execution. 5. Verify that the target is a regular file, is owned by a trusted account, is not a symbolic link, and is not writable by untrusted users. 6. Avoid shell-backed execution. Use an argument-based process API, for example: ```javascript const { execFileSync } = require('child_process'); execFileSync(process.execPath, [coverScript], { stdio: 'inherit', shell: false }); ``` 7. Run the cover generator under a dedicated, low-privilege account or sandbox with access only to required input and output directories. 8. Document the external trust dependency accurately if it cannot be removed. 9. Add tests that fail closed when integrity or ownership verification cannot be completed. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (36)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The high-level description broadly matches the intended workflow: hotspot analysis, article creation, cover generation, and automatic WeChat publishing are all present in the code. However, there is a significant description-behavior mismatch because the declared permissions are empty while the code performs sensitive external actions: it embeds appID/appSecret, authenticates to the WeChat API, uploads media, creates drafts, scrapes a third-party news site, writes to local directories, and invokes external executables/scripts. These are materially important capabilities and resource accesses that should be declared. Therefore this should be flagged as a mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: 声明描述的是一个较宽泛的微信公众号运营工具包，包含文章创作、封面生成、自动发布、热点分析等多项能力；但该代码块的实际用途明显更窄：它读取指定本地文章文件，提取标题和摘要，生成简单封面，上传到微信素材库，并创建公众号草稿。它并不实现热点分析或文章创作，也不是直接“自动发布”到正式发布状态，而是发布到草稿箱。此外，代码硬编码了 appID 和 appSecret，并实际访问微信外部 API、上传本地内容，这属于重要的行为细节，声明中没有准确体现。因此描述与实际行为存在实质不匹配。

Ae1

High

• Category: analysis-evasion

Content

node scripts/full-workflow.js

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Known Vulnerable Dependency: axios==1.13.6 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: The lockfile pins axios 1.13.6, and the finding cites multiple advisories including SSRF-related proxy bypass and prototype-pollution-assisted request/response compromise issues. In a toolkit that performs article creation, cover generation, and automatic publishing, outbound HTTP requests are likely core functionality, so a vulnerable HTTP client meaningfully increases risk of server-side request forgery, credential leakage, request tampering, or MITM-style abuse depending on how the package is used.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

• Category: Supply Chain
• Confidence: 86% confidence
• Finding: form-data 4.0.5 is reported vulnerable to CRLF injection via unescaped multipart field names and filenames. This skill context includes cover generation and auto-publishing, which likely involves file upload and multipart requests; if attacker-controlled metadata reaches multipart construction, it could corrupt requests, inject unintended parts or headers, and potentially abuse downstream services.

Known Vulnerable Dependency: axios==1.13.6 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: The resolved axios version is flagged with multiple advisories, including SSRF-related proxy bypass and severe prototype-pollution-assisted interception issues. In a tool that likely performs authenticated HTTP requests for WeChat automation, exploitation could enable credential theft, request hijacking, SSRF, or manipulation of outbound publishing workflows.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

• Category: Supply Chain
• Confidence: 96% confidence
• Finding: The resolved form-data version is reported vulnerable to CRLF injection via unescaped multipart field names/filenames, which can corrupt multipart requests or inject unintended headers/content boundaries. In a skill that likely uploads article assets or covers, this could be abused if any multipart field metadata is influenced by untrusted input.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The script hardcodes a WeChat appID and appSecret directly in source code, then uses them to obtain an access token and publish content. Embedded secrets are easily exposed through source distribution, logs, backups, or repository history, enabling unauthorized API access and account abuse.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The script embeds a live WeChat `appID` and `appSecret` directly in source code and then uses them to obtain access tokens for publication. Hard-coded secrets are easily exposed through source sharing, logs, backups, or repository history, enabling unauthorized use of the associated WeChat account and API capabilities.

Credential Access

High

• Category: Privilege Escalation

Content

log(`开始发布文章: ${path.basename(articlePath)}`, 'process');
  
  try {
    // 1. 获取 access token
    log('步骤1: 获取 Access Token...', 'process');
    const tokenUrl = `${config.apiBase}/cgi-bin/token?grant_type=client_credential&appid=${config.appID}&secret=${config.appSecret}`;
    const tokenResponse = await axios.get(tokenUrl, { timeout: 10000 });

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

log(`开始发布文章: ${path.basename(articlePath)}`, 'process');
  
  try {
    // 1. 获取 access token
    log('步骤1: 获取 Access Token...', 'process');
    const tokenUrl = `${config.apiBase}/cgi-bin/token?grant_type=client_credential&appid=${config.appID}&secret=${config.appSecret}`;
    const tokenResponse = await axios.get(tokenUrl, { timeout: 10000 });

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

try {
    // 1. 获取 access token
    log('步骤1: 获取 Access Token...', 'process');
    const tokenUrl = `${config.apiBase}/cgi-bin/token?grant_type=client_credential&appid=${config.appID}&secret=${config.appSecret}`;
    const tokenResponse = await axios.get(tokenUrl, { timeout: 10000 });

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

try {
    // 1. 获取 access token
    log('步骤1: 获取 Access Token...', 'process');
    const tokenUrl = `${config.apiBase}/cgi-bin/token?grant_type=client_credential&appid=${config.appID}&secret=${config.appSecret}`;
    const tokenResponse = await axios.get(tokenUrl, { timeout: 10000 });

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

try {
    // 1. 获取 access token
    log('步骤1: 获取 Access Token...', 'process');
    const tokenUrl = `${config.apiBase}/cgi-bin/token?grant_type=client_credential&appid=${config.appID}&secret=${config.appSecret}`;
    const tokenResponse = await axios.get(tokenUrl, { timeout: 10000 });

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README instructs users to run a one-click workflow that performs remote fetching, content generation, and publishing to a WeChat draft box without any warning, confirmation step, or disclosure of outbound network activity. In a skill explicitly designed for automated公众号运营, this increases the chance that a user executes publishing-related automation before understanding what external systems are contacted or what actions are taken with their account.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README tells users to place appID and appSecret directly into a local JSON config file but provides no warning about secret handling, file permissions, accidental commits, or safer alternatives. Because these credentials grant access to a publishing account, poor storage guidance can lead to credential leakage and unauthorized use of the associated WeChat公众号.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

## 常见问题

**Q: 封面生成失败？**
A: 确保已安装 ImageMagick：`sudo apt-get install imagemagick`

**Q: 发布失败？**
A: 检查 appID 和 appSecret 是否正确

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

## 常见问题

**Q: 封面生成失败？**
A: 确保已安装 ImageMagick：`sudo apt-get install imagemagick`

**Q: 发布失败？**
A: 检查 appID 和 appSecret 是否正确

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill documents destructive or data-modifying actions such as one-click publishing, uploading media, and automatic cleanup of old drafts without a prominent warning or confirmation requirement. In an automation context, users may run these commands assuming they are read-only helpers, leading to unintended publication, deletion, or account-side state changes.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The configuration example includes an appSecret in plain JSON without any warning about secret handling. This encourages storing long-lived credentials in files that may be committed, copied, or exposed through logs, enabling unauthorized access to the WeChat account APIs if leaked.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

sudo apt-get install imagemagick

# 安装ImageMagick（CentOS/RHEL）
sudo yum install imagemagick
```

## 工作流程

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The manifest and main feature list describe a toolkit centered on article creation, cover generation, auto-publishing, and hotspot analysis, with a directory structure listing only six scripts. However, the advanced section documents additional operational capabilities such as batch publishing and statistics via `batch-publish.js` and `stats.js`, which are not declared in the directory structure or core feature set. This creates a semantic mismatch between the skill's claimed scope and the behavior/capabilities the documentation says it supports.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: Several configuration values prescribe Chinese-language branding and writing structure, such as the brand, author, signature, and article structure text, without indicating that users can opt into another language or locale. This can violate language/locale policy when a skill implicitly forces a specific language for generated output.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The script's natural-language instructions, generated article template, logs, and publishing target are all fixed in Chinese, indicating a locale-specific behavior. There is no user opt-in, language selection mechanism, or documented justification that the skill is intentionally limited to a Chinese-language workflow.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The manifest describes article creation, cover generation, auto-publishing, and hotspot analysis for WeChat operations. While those outcomes fit the purpose, invoking an unrelated external skill script via `execSync` and later shelling out to system tools introduces code-execution capability that is not justified by the stated business function itself.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.exposed_secret_literal

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/full-workflow.js:165

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/publish-existing.js:98

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/full-workflow.js:217

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/publish-existing.js:46