Security audit

Pharmaceutical Bidding

Security checks for vulnerabilities and agentic risk

Overview

The skill fits its bidding-collection purpose, but it exposes WeCom secrets in logs, sends business data automatically, and includes unsafe scheduling/install patterns that require review before use.

Review and fix the WeCom secret logging before installing. Use least-privilege WeCom credentials, restrict webhook destinations to approved WeCom endpoints, add a dry-run or approval step before records or notifications are sent, and choose one scheduler model instead of installing the supplied crontab alongside the in-process scheduler.

A.I.G

Vulnerability Patterns

System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: validate-wecom-config.js:143
Finding: Plaintext Disclosure of WeCom Authentication and Encryption Secrets
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: test-wechat.js:77
Finding: Partial Disclosure of a Live WeCom Access Token
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: wechat-api.js:22
Finding: Unrestricted Webhook Destination Permits External Disclosure of Collected Records
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: package-lock.json:4546
Finding: Unused Puppeteer Dependency Introduces Unnecessary Install-Time Code Execution
Content: View full analysis
Remediation: View remediation

T06 · System Persistence

Warning

Location: crontab.txt:4
Finding: OS Cron Entry Repeatedly Launches Long-Lived Internal Scheduler Processes
Content: View full analysis
> /home/eio/.openclaw/workspace/skills/pharmaceutical-bidding/logs/cron.log 2>&1 ``` The command starts an application that registers another recurring scheduler: ```javascript startScheduledTask() { // Run every day at 08:30 cron.schedule('30 8 * * *', async () => { console.log('Starting scheduled bidding-information collection task...'); try { await this.executeFullWorkflow(); } catch (error) { console.error('Scheduled task failed:', error.message); } }); } ``` The entry point starts that scheduler and also immediately runs the workflow: ```javascript const collector = new PharmaceuticalBiddingCollector(config); // Start scheduled task collector.startScheduledTask(); // Execute immediately once collector.executeFullWorkflow().catch(console.error); ``` ### Technical Analysis Scheduled execution is explicitly declared functionality, so the presence of scheduling is not covert. However, the provided OS cron entry invokes `npm start`, which launches `main.js`. That process registers a `node-cron` schedule and remains alive waiting for future executions. If the OS crontab entry is installed, another long-lived Node.js process is launched every day. There is no singleton lock, PID check, process supervisor integration, or shutdown mechanism. Consequently, the number of active schedulers can grow over time. Each new process also calls `executeFullWorkflow` immediately, and all previously launched processes retain their own daily schedule. ### Attack Path 1. An administrator installs the supplied `crontab.txt` entry. 2. At 08:30, OS cron invokes `npm start`. 3. `main.js` starts an i ...[truncated 982 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (43)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · WECHAT_SETUP.md (reported line 69)May include surrounding context.
md
### 问题2：API调用失败 **可能原因：** 1. Access Token过期 2. 参数格式错误 3. 权限不足

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · WECHAT_SETUP.md (reported line 168)May include surrounding context.
md
### 问题2：API调用失败 **可能原因：** 1. Access Token过期 2. 参数格式错误 3. 权限不足

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · test-wechat.js (reported line 78)May include surrounding context.
js
### 问题2：API调用失败 **可能原因：** 1. Access Token过期 2. 参数格式错误 3. 权限不足

Credential Access

High

Category: Privilege Escalation
Confidence: 96% confidence
Finding: At this location, the documentation instructs users to retrieve an access token using the application's CorpID and CorpSecret as part of troubleshooting. While obtaining a token is normal, in this context it is immediately paired with printing the token, creating a practical credential exposure path and normalizing unsafe handling of secrets.
Content: Scanner excerpt · WECHAT_SETUP.md (reported line 75)May include surrounding context.
解决方案：

javascript
// 测试获取Access Token const wechatAPI = new WeChatWorkAPI(config); const token = await wechatAPI.getAccessToken(config.wechatWork.corpId, config.wechatWork.corpSecret); console.log('Access Token:', token);

Credential Access

High

Category: Privilege Escalation
Confidence: 99% confidence
Finding: This line logs the access token directly to the console, exposing a valid credential that can be reused by anyone with access to logs or terminal output. Because access tokens are bearer tokens, disclosure can enable unauthorized API calls until the token expires, and such output may be retained in CI/CD or support logs beyond the token lifetime as evidence of poor secret handling.
Content: Scanner excerpt · WECHAT_SETUP.md (reported line 78)May include surrounding context.
// 测试获取Access Token const wechatAPI = new WeChatWorkAPI(config); const token = await wechatAPI.getAccessToken(config.wechatWork.corpId, config.wechatWork.corpSecret); console.log('Access Token:', token);

text
### 问题3：智能表格记录失败

Known Vulnerable Dependency: axios==1.13.6 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

Category: Supply Chain
Confidence: 97% confidence
Finding: axios is a runtime dependency of this collector skill, so known SSRF, proxy bypass, redirect, or prototype-pollution-related flaws can directly affect network-facing behavior. In a scraping/collector context that fetches remote content, this increases risk because attacker-influenced URLs, redirects, or proxy environment handling may allow internal network access, credential leakage, or response tampering.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: basic-ftp==5.2.0 — 4 advisory(ies): GHSA-6v7q-wjvx-w8wg (basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Exe); CVE-2026-39983 (basic-ftp has FTP Command Injection via CRLF); CVE-2026-41324 (basic-ftp vulnerable to denial of service via unbounded memory consumption in Cl) +1 more

High

Category: Supply Chain
Confidence: 80% confidence
Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: brace-expansion==1.1.12 — 4 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-33750 (brace-expansion: Zero-step sequence causes process hang and memory exhaustion); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro) +1 more

High

Category: Supply Chain
Confidence: 80% confidence
Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: browserslist==4.28.1 — 2 advisory(ies): CVE-2026-73088 (Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.); CVE-2026-73089 (Browserslist: Unbounded memory growth (no cache eviction) via distinct query res)

High

Category: Supply Chain
Confidence: 80% confidence
Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: js-yaml==4.1.1 — 4 advisory(ies): CVE-2026-84375 (js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources); CVE-2026-59869 (js-yaml: YAML merge-key chains can force quadratic CPU consumption); GHSA-5p4m-2wfm-xmqj (JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026) +1 more

High

Category: Supply Chain
Confidence: 80% confidence
Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: extract-zip==2.0.1 — 2 advisory(ies): CVE-2026-19693 (extract-zip allows arbitrary file writes through symlink archive entries); CVE-2026-56876 (extract-zip unvalidated symlink path traversal)

High

Category: Supply Chain
Confidence: 80% confidence
Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

Category: Supply Chain
Confidence: 90% confidence
Finding: form-data is a runtime dependency of axios and the cited CRLF injection issue can become dangerous if attacker-controlled field names or filenames are used when building multipart requests. In a data-collection agent, this could enable request smuggling or header/body manipulation toward downstream services if multipart uploads are implemented.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: ip-address==10.1.0 — 2 advisory(ies): CVE-2026-69192 (ip-address: Address4 decodes leading-zero octets as decimal while resolvers deco); CVE-2026-42338 (ip-address has XSS in Address6 HTML-emitting methods)

High

Category: Supply Chain
Confidence: 80% confidence
Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 82% confidence
Finding: The code retrieves an enterprise WeChat access token using configured credentials as part of a test flow. In context this is expected functionality, but handling live credentials and tokens in a test script increases exposure risk, especially if the script is run in shared environments or with verbose logging.
Content: Scanner excerpt · test-wechat.js (reported line 74)May include surrounding context.
js
console.log('\n⚠️ 智能表格ID未配置，跳过表格测试'); } // 测试4: 获取Access Token（如果配置了CorpID和Secret） if (wechatConfig.corpId && wechatConfig.corpSecret) { console.log('\n🔑 测试4: 获取Access Token...'); const token = await wechatAPI.getAccessToken(wechatConfig.corpId, wechatConfig.corpSecret);

Credential Access

High

Category: Privilege Escalation
Confidence: 97% confidence
Finding: The script logs the first 20 characters of the access token to stdout after successful retrieval. Even partial credential disclosure can aid token identification, correlation across logs, or accidental leakage through CI logs, terminals, or centralized log platforms.
Content: Scanner excerpt · test-wechat.js (reported line 76)May include surrounding context.
js
// 测试4: 获取Access Token（如果配置了CorpID和Secret） if (wechatConfig.corpId && wechatConfig.corpSecret) { console.log('\n🔑 测试4: 获取Access Token...'); const token = await wechatAPI.getAccessToken(wechatConfig.corpId, wechatConfig.corpSecret); console.log(`✅ Access Token获取成功: ${token.substring(0, 20)}...`); } else {

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: These lines directly print highly sensitive configuration values including the callback token and EncodingAESKey. Exposure of these values can enable unauthorized parties to forge or interfere with WeCom message validation and compromises secrecy well beyond simple misconfiguration troubleshooting.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The README explicitly describes automatically recording collected bidding information into WeCom smart tables, but it does not warn users that data will be transmitted to an external enterprise service or that automated writes will occur. In an agent skill context, this can lead to unintended exfiltration of collected data, accidental disclosure of procurement-related information, or unauthorized modification of shared business records if users deploy it without understanding the integration.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill explicitly describes automatic collection and population of externally sourced procurement data into a WeChat Work smart table on a daily schedule, but provides no warning, approval gate, or validation controls around outbound transmission and record modification. This creates a real risk of silently sending scraped data to an external business system and overwriting or polluting records with inaccurate, manipulated, or sensitive information.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The troubleshooting example explicitly prints an access token to the console, which can expose a live bearer credential through terminal history, CI logs, shared screenshots, or centralized logging systems. Even in documentation, this pattern encourages unsafe operator behavior and can lead to unauthorized API use if the token is captured.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The code path for recording bidding information does more than the surrounding comment suggests: postToWeChatWork sends a proactive Markdown message to WeChat Work and may also write to a smart table. This creates a transparency and data-minimization issue because collected procurement details are automatically broadcast to an external collaboration platform, which can surprise operators and leak business-sensitive information more broadly than intended.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The workflow automatically transmits collected bidding data to WeChat Work during scheduled and immediate execution without any approval gate, preview, or explicit warning. In this skill context, the data concerns procurement opportunities and internal sales assignment, so unintended transmission can expose commercially sensitive information, cause compliance issues, or notify the wrong audience at scale.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script is described as a configuration validator, but it reads a local config file and later prints secret values such as the WeCom token and EncodingAESKey to stdout. This creates an information-disclosure risk because terminal output may be captured in logs, CI pipelines, shell history, or shared support screenshots.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: All user-facing descriptions and console messages in the file are hard-coded in Chinese, which imposes a specific language on users without opt-in or explanation. Under the language/locale policy, this is a natural-language locale constraint that should either be optional or clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The method is documented as decrypting callback messages, but it only logs and returns the encrypted input unchanged. This can cause downstream code to treat undeciphered data as trusted callback content, breaking security assumptions and potentially leading to incorrect processing, audit gaps, or accidental exposure of sensitive encrypted payloads in logs.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The code logs callback message contents directly with console.log, even though callback payloads may contain sensitive business data or identifiers. In an agent/integration context, logs are often centralized and broadly accessible, so this increases the risk of unintended disclosure without any sanitization or warning.
Content: No source excerpt is available for this finding.