Weixin Connect

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:13 PM UTC
• Version: 1.0.0

Overview

This skill performs a real WeChat connection workflow, but it asks the agent to install mutable packages, upload a live login QR code, persist account tokens, and restart services with too little scoping and control.

Review this skill carefully before installing. It is not judged malicious, but users should only run it if they are comfortable with remote package execution, temporary remote hosting of a live WeChat login QR code, persistent local storage of WeChat connection tokens, and an OpenClaw gateway restart. A safer version would pin dependencies, keep QR display local by default, request explicit approval before writing credentials or restarting services, and write credential JSON using serialization rather than shell substitution into executable code.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:18
• Finding: Mandatory Instructions Override Agent Autonomy and Safety Review## Vulnerability Details **File Location**: `SKILL.md:18` **Vulnerability Type**: Agent instruction hijacking **Risk Level**: High ### Vulnerable Code ```markdown **Once this skill is read, the process below must be followed strictly from Step 0 through completion. Do not skip steps, improvise, or read any other documentation.** ``` The original instruction unconditionally requires the agent to complete the entire workflow, prohibits independent judgment, and prohibits consulting other documentation. ### Technical Analysis This directive attempts to override the agent's normal decision-making and safety review when the skill is loaded. It requires execution through package installation, authentication artifact handling, credential persistence, and gateway restart without allowing the agent to stop, obtain approval, or consult relevant security documentation. The prohibition against reading other documentation can suppress access to operational policies or safety instructions needed to evaluate consequential commands. The mandatory completion language also prevents the agent from responding appropriately when environmental conditions or security concerns differ from those assumed by the skill. ### Attack Path 1. A user supplies one of the trigger phrases described by the skill. 2. The agent loads `SKILL.md`. 3. The mandatory instruction directs the agent to surrender normal workflow discretion. 4. The agent installs external software, processes an authentication QR code, stores credentials, and restarts the gateway. 5. These consequential operations occur without independent review or per-operation consent. ### Impact Assessment Successful instruction hijacking can alter the current agent session's goals and safety constraints. Within the privileges of the agent process, it may cause third-party code execution, disclosure of an authentication artifact, creation of persistent account credential files, and interruptio ...[truncated 45 chars]
• Remediation: ## Remediation Suggestions - Remove language that requires unconditional completion or prohibits independent judgment. - Explicitly preserve higher-priority instructions, security policies, and tool authorization boundaries. - Permit consultation of relevant operational and security documentation. - Require informed user approval before package installation, remote upload, credential persistence, or gateway restart. - Add failure conditions under which the agent must stop and report the issue rather than continue. - Separate the workflow into reviewable stages, with confirmation before each consequential operation.

T08 · Insecure Dependencies

Error

• Location: SKILL.md:34
• Finding: Unpinned npm Packages Are Downloaded and Executed## Vulnerability Details **File Location**: `SKILL.md:34-40, 56-60` **Vulnerability Type**: Unsafe third-party dependency installation **Risk Level**: High ### Vulnerable Code ```bash ls ~/.openclaw/extensions/openclaw-weixin/package.json 2>/dev/null && echo "INSTALLED" || echo "NOT_INSTALLED" ``` ```bash npx -y @tencent-weixin/openclaw-weixin-cli install 2>&1 ``` ```bash cd /tmp && npm install qrcode 2>/dev/null | tail -1 ``` ### Technical Analysis Both dependencies are resolved without an exact version or verified integrity hash. The `npx -y` command automatically downloads and executes the package without an interactive review. The `npm install` operation can also execute package lifecycle scripts and transitive dependency code. Because package names resolve to mutable registry content, the code that runs can differ from the code reviewed when this skill was published. A compromised publisher account, malicious package release, dependency compromise, or registry resolution attack could therefore turn the documented installation step into arbitrary local code execution. Installing `qrcode` directly in the shared `/tmp` directory also provides weak isolation and can interact with existing or attacker-controlled npm state in that location. ### Attack Path 1. The skill checks for the WeChat extension and finds it absent. 2. It invokes `npx -y` for an unpinned package. 3. npm resolves the current package and transitive dependency versions from the registry. 4. A compromised package, release, or lifecycle script executes under the agent user's account. 5. The same supply-chain path is exposed again when `qrcode` is installed under `/tmp`. ### Impact Assessment Malicious dependency code would execute with the operating-system privileges of the agent. It could read or modify user-accessible files, access OpenClaw configuration and credentials, alter extensions, exfiltrate secre ...[truncated 177 chars]
• Remediation: ## Remediation Suggestions - Pin every direct dependency to a reviewed, immutable version. - Use a committed lockfile and verify registry integrity hashes before execution. - Review and pin all transitive dependencies. - Avoid `npx -y` for automatic execution; install into an isolated directory and require explicit approval. - Disable lifecycle scripts where they are unnecessary, such as with `npm install --ignore-scripts`. - Use a dedicated private working directory created with restrictive permissions instead of the shared `/tmp` root. - Prefer a bundled, reviewed QR implementation when practical.

other

Error

• Location: SKILL.md:54
• Finding: Live Authentication QR Code Is Mandatorily Uploaded to an Unspecified CDN## Vulnerability Details **File Location**: `SKILL.md:54-84` **Vulnerability Type**: Sensitive authentication artifact exposure **Risk Level**: High ### Vulnerable Code ```bash cd /tmp && node -e "const qr=require('qrcode'); qr.toFile('/tmp/weixin_qr.png','<qrcode_img_content>',{width:400,margin:2},(e)=>{if(e)console.error(e);else console.log('saved');})" ``` ```text upload_to_cdn /tmp/weixin_qr.png ``` ```bash cp /tmp/weixin_qr.png ~/workspace/weixin_qr.png ``` The workflow requires the CDN upload to be attempted and retried up to three times before local-only fallback is allowed. ### Technical Analysis The generated PNG contains a live WeChat login QR code. Uploading it transfers an authentication artifact to a remote CDN, but the skill does not identify the CDN operator or define transport guarantees, access controls, URL entropy, retention, logging, deletion, or expiration behavior. The upload is unnecessary for the core authentication operation because the skill already preserves a local workspace copy. Mandating remote publication expands the trust boundary and exposes the QR image to the CDN, its logs, anyone who receives the resulting URL, and potentially unintended public discovery. Although the workflow states that the QR code is valid for approximately one minute and mobile confirmation may still be required, disclosure can enable unauthorized scanning, login interference, social engineering, and correlation of the user with the authentication attempt. ### Attack Path 1. The skill requests a live QR payload from the remote WeChat endpoint. 2. It encodes that payload into `/tmp/weixin_qr.png`. 3. It sends the image to the unspecified CDN. 4. The CDN stores the image and returns or records its location. 5. A CDN operator, log reader, unintended recipient, or party obtaining the URL accesses the image during its validity period. 6. That party scans the code or interferes with t ...[truncated 490 chars]
• Remediation: ## Remediation Suggestions - Remove the mandatory CDN upload and display the QR code locally by default. - Obtain explicit informed consent before transferring any authentication artifact to a remote service. - If remote hosting is essential, use an identified and trusted private service with authenticated access. - Apply a short server-side expiration, single-use access, non-indexable URLs, minimal logging, and immediate deletion after confirmation or expiry. - Document the service operator, retention policy, access-control model, and data-processing boundaries. - Create local QR files with restrictive permissions and securely delete them after use or expiration.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:149
• Finding: Remote API Values Are Unsafely Interpolated into Executable JavaScript## Vulnerability Details **File Location**: `SKILL.md:149-182` **Vulnerability Type**: Code injection through unsafe source generation **Risk Level**: Critical ### Vulnerable Code ```javascript const accountId = '__ACCOUNT_ID__'; const data = { token: '__ILINK_BOT_ID__:__BOT_TOKEN__', savedAt: new Date().toISOString(), baseUrl: '__BASEURL__', userId: '__ILINK_USER_ID__' }; ``` ```bash sed -i 's/__ACCOUNT_ID__/<accountId>/g; s/__ILINK_BOT_ID__/<ilink_bot_id>/g; s/__BOT_TOKEN__/<bot_token>/g; s/__BASEURL__/<baseurl>/g; s/__ILINK_USER_ID__/<ilink_user_id>/g' /tmp/write_weixin_account.js && node /tmp/write_weixin_account.js ``` ### Technical Analysis Values returned by the ilink API are inserted directly into JavaScript source code using `sed`. The workflow specifies no validation or escaping for either JavaScript string syntax or `sed` replacement syntax. Characters such as single quotes, backslashes, ampersands, delimiters, and line breaks can alter the generated source or replacement operation. If an upstream response is malicious or compromised, a crafted field can terminate its JavaScript string and append executable statements. The generated file is then immediately executed with Node.js. Even non-malicious values containing reserved replacement characters can corrupt credentials or cause the script to fail. This is a source-generation vulnerability: untrusted data is treated as executable program text instead of serialized data. ### Attack Path 1. The agent polls the ilink endpoint and receives `ilink_bot_id`, `bot_token`, `baseurl`, and `ilink_user_id`. 2. An attacker controlling or tampering with the upstream response supplies a value containing JavaScript syntax and characters that survive or manipulate the `sed` replacement. 3. The agent substitutes the value into `/tmp/write_weixin_account.js` without contextual escaping. 4. The crafted value escapes ...[truncated 641 chars]
• Remediation: ## Remediation Suggestions - Do not generate JavaScript source code by substituting API-derived values. - Validate the API response schema, expected types, maximum lengths, and allowed formats before use. - Store the response in a data-only JSON file using a trusted JSON serializer. - Pass the JSON file path to a fixed, reviewed script and parse it with `JSON.parse`. - If values must be embedded programmatically, serialize every value with `JSON.stringify` rather than shell replacement. - Avoid placing secrets in command-line arguments because they may appear in process listings or logs. - Create temporary files with exclusive creation and restrictive permissions, use a private temporary directory, and delete them after use. - Authenticate the upstream connection and reject responses that fail validation before any local state is modified.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The skill installs and executes a package via `npx -y` without pinning an exact version or verifying integrity, which creates a supply-chain execution path at runtime. If the package is updated maliciously, compromised, or if resolution is manipulated, the agent may run attacker-controlled code on the host with the user's permissions.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill directs the agent to write long-lived credential material to local files and restart the gateway, but it does not require explicit user consent or prominently warn about these system modifications. In a skill that handles personal WeChat linkage, this is security-sensitive because it persists authentication state and changes service state on the machine, increasing the chance of unintended account binding, credential exposure, or disruptive configuration changes.

Static analysis

No suspicious patterns detected.