ClawHub
Back to skill

Security audit

Wechat Blog Write Publish

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says: it helps create a WeChat article, save it locally, and publish it to a WeChat draft box, but users should handle content and WeChat credentials carefully.

Install only if you intend to publish content to a WeChat official account. Review the generated article and assets before publishing, do not use private or proprietary material unless approved, and protect the WeChat AppSecret like a password.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The README promotes one-click publication to the WeChat draft box but does not clearly warn that article text, images, and metadata will be transmitted to Tencent/WeChat services. Users may unknowingly send sensitive or proprietary content to an external platform, creating privacy, confidentiality, and compliance risk.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The documentation instructs users to configure AppID and AppSecret but provides no guidance on secure secret handling. This can lead users to expose credentials in shell history, screenshots, shared terminals, or checked-in config files, enabling unauthorized access to the associated WeChat account.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill explicitly instructs creating local Markdown files and publishing content to the WeChat draft box, which are real side effects involving file creation and third-party data transmission. Because these actions are presented as part of the normal workflow without a clear, explicit warning or confirmation step, a user or agent could send sensitive reference material externally or write files unexpectedly.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill includes operational guidance for configuring `AppID` and `AppSecret` and shows passing them on the command line, but it does not warn that these are sensitive credentials that should be handled securely. This increases the risk of accidental exposure through shell history, logs, screenshots, or insecure storage, potentially enabling unauthorized access to the connected WeChat account.

Static analysis

No suspicious patterns detected.