Security audit

wecom-doc

Security checks for vulnerabilities and agentic risk

Overview

The skill’s WeCom document purpose is coherent, but its setup can install a global npm tool and configure remote MCP endpoints from unvalidated local or user-provided values.

Install only if you trust the mcporter npm package and the WeCom/OpenClaw environment. Do not paste MCP URLs or JSON configuration from untrusted sources, and verify the endpoint before allowing the skill to configure it because future document actions will use that server.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:50
Finding: Unpinned Global npm Package Installation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:311
Finding: Shell Command Injection Through Untrusted MCP Configuration Values
Content: View full analysis
" \ --url "" ``` ```bash mcporter config add wecom-doc \ --type streamable-http \ --url "" ``` ```bash mcporter config add wecom-doc \ --type streamable-http \ --url "" ``` The values originate either from `~/.openclaw/wecomConfig/config.json` or directly from user-provided URL and JSON content. ### Technical Analysis The Skill directs the agent to interpolate externally controlled values into shell command strings. Placing a value between double quotes does not make arbitrary input safe for shell execution. A value containing a double quote can terminate the quoted argument, after which shell operators, command substitutions, redirections, or additional commands may be interpreted by the shell. For example, a malicious value following this structural pattern could escape the intended URL argument: ```text https://example.invalid/" ; ATTACKER_COMMAND ; # ``` The instructions do not require: - Parsing JSON with a strict JSON parser. - Validating the MCP type against a fixed allowlist. - Restricting the URL scheme and host. - Rejecting quotes, control characters, or shell metacharacters. - Passing arguments through a process API that bypasses shell interpretation. - Applying correct shell escaping before command construction. The same issue applies to values read from the local OpenClaw configuration file. Although that file is local, it may be populated by another component or modified by an attacker who has obtained write access to the user's configuration directory. Di ...[truncated 1769 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill declares that vague requests like 'help me write a document' should default to this integration without confirming platform intent. That broad trigger can cause unintended activation of a tool-capable skill, increasing the chance of accidental document creation, editing, or environment-modifying setup actions when the user only wanted general writing help.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill instructs installing a global npm package that changes the host environment. Although it asks for confirmation first, it does not disclose the security implications of executing a system-wide install from the network, which could surprise users and expands the trusted computing base.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The skill reads a local config file containing MCP connection details and uses its contents for automatic configuration without notifying the user that local sensitive runtime data is being accessed. Even if intended for convenience, this reduces transparency and can expose internal service endpoints or trust relationships to unintended workflows.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill accepts locally sourced or user-provided URLs and feeds them directly into MCP configuration, causing future tool calls to connect to an arbitrary remote endpoint. This creates a clear SSRF/trust-boundary problem: a malicious or mistaken URL could redirect the agent to an attacker-controlled MCP server that returns deceptive tool metadata or performs unauthorized actions.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill claims editing is restricted to documents created within the current session, but later allows dynamic configuration of the backing MCP endpoint from local config or user-supplied URLs. That means the real authorization boundary is delegated to whatever remote MCP server gets configured, so the documented safety guarantee is weaker than represented and may permit operations on arbitrary documents if the endpoint is broader than assumed.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The stated purpose is document and smart-sheet operations, but the instructions also direct the agent to read ~/.openclaw/wecomConfig/config.json, inspect OPENCLAW_SHELL, and query OpenClaw channel configuration. These host/environment inspection capabilities are not part of the user-facing document workflow itself; they are ancillary bootstrapping behavior. While operationally convenient, this is broader than the manifest's narrowly stated document-editing purpose.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The entire reference is written in Chinese and does not indicate that another language is available or that the Chinese-only presentation is an intentional, documented locale constraint. Under the policy for natural-language issues, forcing a specific language without user opt-in can be a violation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.