Wecom Channel Fix

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:40 PM UTC
• Version: 0.1.0

Overview

The skill is a coherent WeCom configuration repair guide, but it handles bot secrets and recommends open group access without enough safeguards.

Review this skill before installing or using it. If you use it, avoid pasting real WeCom secrets into chat, avoid commands that print full secret-bearing config, enter secrets through safer mechanisms if available, and replace the open group policy with explicit trusted senders or groups unless you intentionally want broad group access.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:51

Finding

WeCom secret exposed through configuration output and command-line arguments

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:51 and SKILL.md:189
Vulnerability Type: Sensitive credential exposure
Risk Level: High

Vulnerable Code

bash

openclaw config get channels.wecom 2>&1

bash

openclaw config set channels.wecom.secret <YOUR_SECRET>

Technical Analysis

The diagnostic command retrieves the complete channels.wecom configuration. Based on the documented configuration structure, this object contains the WeCom bot secret. If the CLI does not redact sensitive values, the secret can be written to the terminal, captured in Agent context, or retained in conversation and execution logs.

The repair command also asks the operator to supply the secret as a command-line argument. After placeholder substitution, the plaintext secret may be retained in shell history, process telemetry, audit logs, terminal recordings, or diagnostic output. On systems where process arguments are visible to other local users, it may also be exposed during command execution.

Attack Path

1. An operator invokes the skill to diagnose a WeCom connection problem.
2. The Agent executes openclaw config get channels.wecom.
3. The CLI returns the complete configuration, potentially including the plaintext secret.
4. The output is captured in the Agent transcript, terminal logs, or other observability systems.
5. Alternatively, during repair, the operator replaces <YOUR_SECRET> with the real credential.
6. The resulting command is stored in shell history or captured through process and command auditing.
7. A party with access to those records obtains the secret and can attempt to authenticate as the associated WeCom bot.

Impact Assessment

Disclosure may allow unauthorized use or impersonation of the configured WeCom bot, subject to the permissions and capabilities assigned to that bot. The exposure scope includes local shell history, Agent transcripts, ex ...[truncated 224 chars]

Remediation

View remediation

Remediation Suggestions

• Do not retrieve the entire channels.wecom object during routine diagnostics.
• Query only non-sensitive fields, such as enabled, or use a command that reports whether a secret is configured without returning its value.
• Explicitly redact values under keys such as secret, token, and credential before displaying or retaining command output.
• Do not pass the secret directly through command-line arguments.
• Accept secrets through a no-echo interactive prompt, protected standard input, a secret manager, or another mechanism that does not expose them in process arguments.
• Instruct users never to paste real credentials into chat or Agent transcripts.
• Disable shell-history recording for unavoidable sensitive operations and ensure diagnostic logs do not contain configuration secrets.
• Rotate the WeCom secret if the documented commands were previously executed with a real credential and the output or shell history may have been retained.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:238

Finding

Recommended configuration permits unrestricted WeCom group access

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:238-239
Vulnerability Type: Overly permissive channel authorization
Risk Level: Medium

Vulnerable Code

json

"allowFrom": [],
"groupPolicy": "open"

Technical Analysis

The recommended single-account configuration combines an empty sender allowlist with an open group policy. This configuration does not establish an explicit trust boundary for group-originated messages and may permit untrusted WeCom group participants to interact with the connected Agent.

An Agent exposed through a group channel can receive attacker-controlled prompts. If the Agent has access to local tools, files, messaging functions, or other integrations, those prompts may attempt to induce actions under the Agent's existing privileges. The configuration therefore violates least-privilege principles by recommending open access as the default instead of requiring an explicit set of trusted senders or groups.

Attack Path

1. An operator copies the recommended configuration into openclaw.json.
2. The gateway is restarted with groupPolicy set to open and no explicit trusted-sender entries.
3. An untrusted participant in a connected WeCom group sends a crafted message to the bot.
4. The channel forwards the message to the Agent.
5. The message attempts to manipulate the Agent into disclosing information or invoking available tools.
6. If the Agent accepts the request and its normal authorization controls do not block it, the requested operation executes using the Agent's configured capabilities.

Impact Assessment

The immediate impact is unauthorized access to the Agent's messaging interface by group participants who were not explicitly approved. The maximum downstream impact depends on the Agent's configured capabilities and independent authorization controls. It can include unauthorized tool requests, disclosure of information available to the Agent, unwanted out ...[truncated 225 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the open group policy with the most restrictive supported policy by default.
• Require operators to enumerate trusted sender, group, or tenant identifiers in an allowlist.
• Document the precise semantics of an empty allowFrom array and avoid presenting it as secure unless the plugin treats it as deny-all.
• Require explicit operator confirmation before enabling open group access.
• Apply authorization checks independently of prompt content before permitting sensitive Agent tools or actions.
• Use a minimally privileged Agent profile for group channels, with filesystem, command-execution, administrative, and secret-access capabilities disabled unless essential.
• Log and monitor rejected and accepted sender identities, and periodically review the allowlist.
• Clearly warn that enabling an open policy exposes the Agent to attacker-controlled messages and prompt-injection attempts from group participants.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.