ClawHub
Back to skill

Security audit

WeChat GZH

Security checks for vulnerabilities and agentic risk

Overview

This WeChat Official Account skill is mostly purpose-aligned, but it handles powerful publishing/deletion actions and sensitive credentials with too little protection.

Review this before installing if the agent may run commands from broad natural-language prompts. Use a restricted config file or secret store, avoid passing AppSecret on the command line, avoid logging get-token output, and require explicit confirmation before publishing or deleting WeChat content.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/wechat_gzh.py:543
Finding

AppSecret Exposure Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: scripts/wechat_gzh.py:543
Vulnerability Type: Sensitive credential exposure through process arguments
Risk Level: Medium

python
parser.add_argument('--secret', help='AppSecret（覆盖配置文件）')

Technical Analysis

The CLI accepts the reusable WeChat AppSecret directly through the --secret argument. Command-line arguments may be retained in shell history, captured in CI/CD job definitions and logs, or exposed to local process-inspection facilities, depending on the operating system and its access controls.

Unlike a short-lived token, the AppSecret is a long-term application credential. An exposed AppSecret can be combined with the corresponding AppID to request new access tokens repeatedly until the credential is rotated.

Attack Path

  1. A user runs the client with --secret APP_SECRET, potentially from an interactive shell or automation system.
  2. The full command is retained in shell history, process telemetry, CI configuration, or execution logs.
  3. An attacker with access to one of those records obtains the AppSecret and corresponding AppID.
  4. The attacker submits those credentials to the official WeChat stable-token endpoint.
  5. After receiving an access token, the attacker invokes the WeChat APIs permitted for that Official Account.

Impact Assessment

Successful exploitation may allow an attacker to obtain account access tokens and exercise the WeChat API privileges granted to the application. Based on this skill's supported operations, relevant effects may include reading materials and publication data, uploading materials, publishing drafts, and deleting published articles. The exact scope remains constrained by the permissions and account type configured by WeChat.

Remediation
View remediation

Remediation Suggestions

  • Remove the --secret command-line option.
  • Load the AppSecret from a permission-restricted configuration file, operating-system credential store, or dedicated secret manager.
  • If interactive entry is necessary, read the secret with getpass.getpass() so it is neither echoed nor supplied through the process argument vector.
  • Ensure configuration files containing credentials are restricted to the owning user, such as mode 0600 on supported systems.
  • Prevent secret values from being included in application logs, exception messages, telemetry, or CI job output.
  • Rotate any AppSecret that has previously been supplied through command-line arguments in an environment where command history or execution logs may be accessible.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/wechat_gzh.py:576
Finding

Access Token Disclosed in Plaintext CLI Output

Content
View full analysis

Vulnerability Details

File Location: scripts/wechat_gzh.py:576-578
Vulnerability Type: Plaintext disclosure of a reusable access token
Risk Level: Medium

python
if args.command == 'get-token':
    token = wechat.get_stable_access_token()
    print(f"Access Token: {token}")

Technical Analysis

The get-token command prints the complete WeChat access token to standard output. Standard output is commonly captured by terminal scrollback, shell redirection, CI/CD logs, monitoring agents, session recording systems, and centralized log collectors.

The token is a bearer credential: possession is sufficient to authorize API requests until it expires or is invalidated. No additional proof of identity is required when the token is used against supported WeChat API endpoints.

Attack Path

  1. A user invokes the get-token command in a terminal, script, or CI/CD job.
  2. The complete bearer token is written to standard output.
  3. Terminal output, redirected output, or automation logs retain the token.
  4. An attacker with access to that output extracts the token before it expires.
  5. The attacker supplies the token as the access_token parameter to authorized WeChat API endpoints.
  6. The attacker performs operations available to the compromised account and token.

Impact Assessment

Exposure permits unauthorized API access for the remaining lifetime of the token. Depending on the WeChat account's granted permissions, this can expose materials, drafts, and published content or allow state-changing actions such as uploading materials, publishing drafts, and deleting articles. The compromise is temporally limited by token expiration or invalidation, but captured tokens remain directly usable during that period.

Remediation
View remediation

Remediation Suggestions

  • Do not print full access tokens by default.
  • Replace the command output with a confirmation that token retrieval succeeded, or display only a short masked fingerprint.
  • If raw token output is operationally indispensable, require an explicit opt-in flag and display a warning that the output must not be logged.
  • Prefer an internal token cache or secure inter-process credential mechanism instead of transferring bearer tokens through console output.
  • Configure CI/CD systems and log collectors to redact token-shaped values and disable command output capture for credential operations.
  • Invalidate or refresh tokens suspected of having been captured in logs, and securely remove affected logs where feasible.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (28)

Credential Access

High
Category
Privilege Escalation
Confidence
89% confidence
Finding

The skill explicitly requests context-reading access for workspace files and environment variables to obtain app credentials, which creates real credential exposure risk if the skill is invoked too broadly or implemented unsafely. In an agent environment, a skill with secret-reading capability plus outbound API access can misuse or unintentionally leak sensitive tokens and app secrets.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: wechat-gzh
description: "微信公众号管理 skill。支持获取 Access Token、永久素材管理、发布能力（发布草稿、查询发布状态、获取已发布列表、删除发布文章）。触发词：微信公众号、wechat gzh、发布图文、素材管理。"
permissions:
  - type: context_reading
    purpose: "读取微信公众号配置和凭证"

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

md
{
  "name": "wechat-gzh",
  "version": "1.0.0",
  "description": "微信公众号管理 skill - 支持 Access Token、素材管理、发布能力",
  "created": "2026-03-25",
  "author": "adventurer",
  "dependencies": {

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

md
{
  "name": "wechat-gzh",
  "version": "1.0.0",
  "description": "微信公众号管理 skill - 支持 Access Token、素材管理、发布能力",
  "created": "2026-03-25",
  "author": "adventurer",
  "dependencies": {

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

md
{
  "name": "wechat-gzh",
  "version": "1.0.0",
  "description": "微信公众号管理 skill - 支持 Access Token、素材管理、发布能力",
  "created": "2026-03-25",
  "author": "adventurer",
  "dependencies": {

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

md
{
  "name": "wechat-gzh",
  "version": "1.0.0",
  "description": "微信公众号管理 skill - 支持 Access Token、素材管理、发布能力",
  "created": "2026-03-25",
  "author": "adventurer",
  "dependencies": {

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.

md
{
  "name": "wechat-gzh",
  "version": "1.0.0",
  "description": "微信公众号管理 skill - 支持 Access Token、素材管理、发布能力",
  "created": "2026-03-25",
  "author": "adventurer",
  "dependencies": {

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · _meta.json (reported line 4)May include surrounding context.

json
{
  "name": "wechat-gzh",
  "version": "1.0.0",
  "description": "微信公众号管理 skill - 支持 Access Token、素材管理、发布能力",
  "created": "2026-03-25",
  "author": "adventurer",
  "dependencies": {

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/wechat_gzh.py (reported line 7)May include surrounding context.

python
{
  "name": "wechat-gzh",
  "version": "1.0.0",
  "description": "微信公众号管理 skill - 支持 Access Token、素材管理、发布能力",
  "created": "2026-03-25",
  "author": "adventurer",
  "dependencies": {

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/wechat_gzh.py (reported line 82)May include surrounding context.

python
{
  "name": "wechat-gzh",
  "version": "1.0.0",
  "description": "微信公众号管理 skill - 支持 Access Token、素材管理、发布能力",
  "created": "2026-03-25",
  "author": "adventurer",
  "dependencies": {

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/wechat_gzh.py (reported line 518)May include surrounding context.

python
{
  "name": "wechat-gzh",
  "version": "1.0.0",
  "description": "微信公众号管理 skill - 支持 Access Token、素材管理、发布能力",
  "created": "2026-03-25",
  "author": "adventurer",
  "dependencies": {

Credential Access

High
Category
Privilege Escalation
Confidence
97% confidence
Finding

The CLI prints the full access token directly to stdout. In many environments stdout is captured by shell history, CI logs, terminal recording, agent transcripts, or centralized logging, which can expose a bearer credential to unintended parties and enable unauthorized API actions until expiry.

Content

Scanner excerpt · scripts/wechat_gzh.py (reported line 578)May include surrounding context.

python
# 执行命令
        if args.command == 'get-token':
            token = wechat.get_stable_access_token()
            print(f"Access Token: {token}")
        
        elif args.command == 'list-published':
            result = wechat.get_published_list(

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill exposes destructive operations such as deleting drafts and deleting published articles, but the description and usage sections do not prominently warn users that these actions are irreversible or operationally risky. In an agent setting, lack of clear user-facing warnings can lead to accidental content deletion or unintended publication changes when the skill is invoked through natural-language prompts.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

EOF

设置权限

chmod 600 ~/.wechat_gzh_config.json

text

## 使用方法

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The description is written as a Chinese-only capability statement ("微信公众号管理 skill - 支持 Access Token、素材管理、发布能力") with no indication that other languages are supported or that this locale constraint is optional. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the regional constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/wechat_gzh.py (reported line 40)May include surrounding context.

python
f"配置文件不存在: {config_path}\n"
                f"请创建配置文件:\n"
                f'  echo \'{{"appid": "your_appid", "secret": "your_secret"}}\' > {config_path}\n'
                f"  chmod 600 {config_path}"
            )
        
        with open(config_path) as f:

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

md
class WeChatGZH:
    """微信公众号 API 客户端"""
    
    BASE_URL = "https://api.weixin.qq.com/cgi-bin"
    
    def __init__(self, config: WeChatConfig = None, config_path: str = None):
        """初始化客户端"""

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.

md
class WeChatGZH:
    """微信公众号 API 客户端"""
    
    BASE_URL = "https://api.weixin.qq.com/cgi-bin"
    
    def __init__(self, config: WeChatConfig = None, config_path: str = None):
        """初始化客户端"""

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.

md
class WeChatGZH:
    """微信公众号 API 客户端"""
    
    BASE_URL = "https://api.weixin.qq.com/cgi-bin"
    
    def __init__(self, config: WeChatConfig = None, config_path: str = None):
        """初始化客户端"""

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.

md
class WeChatGZH:
    """微信公众号 API 客户端"""
    
    BASE_URL = "https://api.weixin.qq.com/cgi-bin"
    
    def __init__(self, config: WeChatConfig = None, config_path: str = None):
        """初始化客户端"""

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.

md
class WeChatGZH:
    """微信公众号 API 客户端"""
    
    BASE_URL = "https://api.weixin.qq.com/cgi-bin"
    
    def __init__(self, config: WeChatConfig = None, config_path: str = None):
        """初始化客户端"""

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 116)May include surrounding context.

md
class WeChatGZH:
    """微信公众号 API 客户端"""
    
    BASE_URL = "https://api.weixin.qq.com/cgi-bin"
    
    def __init__(self, config: WeChatConfig = None, config_path: str = None):
        """初始化客户端"""

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

md
class WeChatGZH:
    """微信公众号 API 客户端"""
    
    BASE_URL = "https://api.weixin.qq.com/cgi-bin"
    
    def __init__(self, config: WeChatConfig = None, config_path: str = None):
        """初始化客户端"""

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 118)May include surrounding context.

md
class WeChatGZH:
    """微信公众号 API 客户端"""
    
    BASE_URL = "https://api.weixin.qq.com/cgi-bin"
    
    def __init__(self, config: WeChatConfig = None, config_path: str = None):
        """初始化客户端"""

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.

md
class WeChatGZH:
    """微信公众号 API 客户端"""
    
    BASE_URL = "https://api.weixin.qq.com/cgi-bin"
    
    def __init__(self, config: WeChatConfig = None, config_path: str = None):
        """初始化客户端"""

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.

md
class WeChatGZH:
    """微信公众号 API 客户端"""
    
    BASE_URL = "https://api.weixin.qq.com/cgi-bin"
    
    def __init__(self, config: WeChatConfig = None, config_path: str = None):
        """初始化客户端"""