微信定时推送

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:27 AM UTC
• Version: 2.0.0

Overview

This skill is a coherent WeChat reminder helper, but it gives agents broad recurring message and local session/credential lookup instructions without enough user-control and privacy safeguards.

Install only if you understand that it can create scheduled WeChat messages, including recurring ones. Verify the target sessionKey, recipient, account, schedule, and delete-after-run behavior before allowing task creation, avoid exposing ~/.openclaw account/session files or bearer tokens, and prefer pinned or verified installer versions.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: references/weixin-api.md:12

Finding

Unpinned Third-Party Package Is Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: references/weixin-api.md, line 12
Vulnerability Type: Supply-chain exposure through mutable package execution
Risk Level: Medium

Vulnerable Code Snippet:

bash

npx -y @tencent-weixin/openclaw-weixin-cli install

Technical Analysis

The documented installation command invokes npx without specifying an exact package version. Consequently, it resolves the package version available from the configured package registry at execution time, downloads it, and runs its package-defined executable and installation logic.

The -y option suppresses the interactive installation confirmation. The command also provides no integrity hash, package-signature check, registry restriction, or documented version-verification step. Therefore, the code ultimately executed can differ from the code that was reviewed when this Skill was published.

This creates a supply-chain trust boundary: compromise of the package, its publisher account, the configured registry, or a newly published package version could convert the documented installation step into arbitrary local code execution.

Attack Path

1. An attacker compromises the package publisher, package registry, or an upstream release process.
2. The attacker publishes a malicious or backdoored version of @tencent-weixin/openclaw-weixin-cli.
3. A user follows the documented unversioned npx -y command.
4. npx resolves and downloads the attacker-controlled current version.
5. Package installation or CLI code executes with the privileges of the user running the command.
6. The malicious package can access data available to that user, including local OpenClaw configuration and credentials.

Impact Assessment

Successful exploitation can provide arbitrary code execution under the invoking user's account. The accessible scope may include OpenClaw configuration, WeChat account tokens, session metadata, files readable by ...[truncated 284 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the dependency to a reviewed exact version, for example:

  bash

  npx --yes @tencent-weixin/openclaw-weixin-cli@<reviewed-exact-version> install
  

• Document the expected official registry and instruct users to verify their registry configuration before installation.

• Publish and verify an integrity digest or signed release artifact where the package ecosystem supports it.

• Review the pinned package version, including lifecycle scripts and transitive dependencies, before recommending execution.

• Avoid suppressing interactive confirmation unless automation requires it and all validation has already occurred.

• Run installation with a least-privileged account and prevent the installer from accessing unrelated credentials.

• Establish a controlled process for reviewing and deliberately updating the pinned version.

T05 · Unauthorized Access and Privilege Escalation

Note

• Location: SKILL.md:76

Finding

Session Discovery Enumerates All Agents Beyond the Required Scope

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 76
Vulnerability Type: Excessive access to cross-agent session metadata
Risk Level: Low

Vulnerable Code Snippet:

bash

# 方法1：从会话列表查找（找含 openclaw-weixin 的 key）
openclaw sessions --json --all-agents | grep openclaw-weixin

Technical Analysis

The command requests session information for all agents through --all-agents, although the stated task only requires locating the relevant WeChat session key for the current agent and intended recipient. Filtering with grep occurs only after OpenClaw has produced the complete cross-agent session listing.

This violates least-privilege and data-minimization principles. It unnecessarily exposes session routing identifiers and associated metadata to the process pipeline and terminal output. The textual filter also does not establish ownership or recipient identity, so a matching key belonging to another agent, account, or user could be selected accidentally.

A session key functions as a routing identifier in the documented cron workflow. Exposure or misuse could therefore cause a scheduled message to be associated with an unintended WeChat conversation. Exploitation remains constrained by the permissions enforced by the local OpenClaw installation and does not independently bypass operating-system access controls.

Attack Path

1. A user or agent follows the documented session-discovery procedure.
2. The --all-agents option causes OpenClaw to retrieve session records across every agent visible to the caller.
3. The full output enters the shell pipeline before grep filters matching text.
4. Multiple WeChat session keys may be displayed without reliable account or recipient verification.
5. A user, automation process, or locally present observer obtains or selects a session key belonging to an unintended agent or recipient.
6. That key is supplied to openclaw cron add, potentially causing future ...[truncated 666 chars]

Remediation

View remediation

Remediation Suggestions

• Remove --all-agents and query only the current agent or explicitly selected account.
• Prefer a structured query mechanism over a textual grep filter.
• Require explicit confirmation of the intended agent, WeChat account, and recipient before creating a cron job.
• If broad enumeration is unavoidable, display only the minimum fields required and redact unrelated session metadata.
• Add a validation step that confirms the selected session key belongs to the active account and expected recipient.
• Ensure OpenClaw enforces authorization when session keys are used rather than treating possession of a routing identifier as sufficient authority.
• Avoid logging or retaining session listings in shell history, CI logs, or other shared output channels.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The README explicitly describes scheduling proactive WeChat messages to specific users via sessionKey, but it does not warn about consent, privacy, or abuse risks such as unsolicited messaging or surveillance-like use. Because this skill is designed to push messages to identified individuals on a recurring basis, the lack of safety guidance increases the chance of misuse even if the feature is intended for legitimate reminders.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation instructs operators to retrieve user identifiers from local account JSON files and compose session keys, but it does not warn that these files may contain sensitive account metadata that should not be broadly exposed or copied into logs, prompts, or screenshots. In a system that routes messages to individual WeChat users, mishandling these identifiers can enable misdelivery, privacy violations, or unauthorized targeting of users.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger phrases are very broad everyday requests such as reminders, daily pushes, and notifications, which can cause the skill to activate in ambiguous contexts. Because this skill creates proactive outbound messages, accidental invocation can schedule persistent or unwanted communications to a user's WeChat account.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The introductory description explains mechanics but does not clearly warn that the skill will send proactive scheduled messages to the user's WeChat account, potentially on a recurring basis. Users or operators may underestimate the consequence of invocation, increasing the risk of surprise messaging, spammy behavior, or misconfiguration affecting the wrong recipient.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill provides concrete methods to locate session keys and user IDs from local session and account files without any privacy or authorization warning. In context, these identifiers determine which WeChat user receives messages, so exposing lookup techniques increases the risk of cross-user targeting, unauthorized messaging, and leakage of sensitive local metadata.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The documentation instructs users to run an unpinned package directly via npx, which fetches the latest published CLI at execution time. If the package publisher account or dependency chain is compromised, users could execute attacker-controlled code on their local system during installation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The file documents the exact location and format of stored bot credentials, including a bearer token, without any warning that this file is sensitive or should be protected with strict filesystem permissions. In the context of a Weixin bot that can proactively send messages to users, token theft could let an attacker impersonate the bot, access account functionality, and route unauthorized messages to users.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README presents all operational instructions in Chinese and does not indicate that the skill is Chinese-only or provide an alternative language option. This can violate language/locale policy expectations when a skill implicitly forces a specific language without user opt-in or justification.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill documents multiple ways to enumerate local session data and account files to derive WeChat routing identifiers. Even if intended for legitimate setup, exposing procedures to read stored session metadata broadens access to user identifiers beyond the minimum needed for scheduling and can enable targeting or privacy leakage if used by an agent without strong consent checks.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.