ClawHub
Back to skill

Security audit

公众号文章导出 MD 知识库

Security checks across malware telemetry and agentic risk

Overview

This skill does what it says: it uses your logged-in WeChat admin browser session to export your own public account articles into local Markdown files.

Install only if you are comfortable letting this skill use your currently logged-in WeChat Official Account admin browser session. Run it while logged into the account you intend to archive, and choose an output directory that may contain article titles, URLs, authors, dates, and full article text.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill explicitly enumerates browser tabs and extracts the authenticated WeChat admin token from either a user-supplied backend URL, an already-open mp.weixin.qq.com admin tab, or a newly opened admin page. Even though the token is used locally and for the stated purpose of exporting the user's own content, it is still sensitive session material and the code accesses it silently at runtime without a just-in-time consent prompt or a narrowly scoped retrieval mechanism.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.