ClawHub
Back to skill

Security audit

WeChat Article Archive

Security checks across malware telemetry and agentic risk

Overview

This skill coherently saves user-selected WeChat articles into a local folder, with no evidence of hidden data collection or destructive behavior.

Install this if you want local WeChat article archives and are comfortable letting it fetch WeChat content and write Markdown/images into a folder you choose. Use a dedicated output folder, avoid setting NODE unless you trust the path, and refresh dependencies from trusted registries.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Tainted flow: 'node' from os.environ.get (line 28, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Content
env = os.environ.copy()
    if html_file:
        env["WECHAT_HTML_FILE"] = str(html_file)
    res = subprocess.run(
        [node, "-e", js],
        capture_output=True,
        text=True,
Confidence
91% confidence
Finding
The executable name comes from os.environ.get('NODE'), so anyone controlling the process environment can redirect execution to an arbitrary binary or script. Because this skill is designed to process untrusted content and may run in automation contexts, environment-controlled code execution can lead to full compromise of the agent runtime or data accessible to it.

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill instructs the agent to execute local shell commands, access environment variables, write files to user-specified locations, and fetch remote content, yet it declares no permissions or equivalent safety boundaries. This mismatch increases the risk that the agent can perform sensitive actions without explicit review, especially because both the URL and destination folder are user-controlled inputs and the workflow can reach the local filesystem and network.

Unpinned Dependencies

Low
Category
Supply Chain
Content
beautifulsoup4>=4.12
Confidence
87% confidence
Finding
The dependency is specified with a lower-bound only (beautifulsoup4>=4.12), which allows future unreviewed versions to be installed. This can introduce supply-chain risk, unexpected breaking changes, or newly introduced vulnerable releases without the skill author explicitly validating them.

Known Vulnerable Dependency: qs==6.15.0 — 1 advisory(ies): CVE-2026-8723 (qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/u)

Low
Category
Supply Chain
Confidence
90% confidence
Finding
The manifest includes qs 6.15.0, which is flagged with a known DoS advisory where qs.stringify can crash with a TypeError on null/undefined input. If this skill processes attacker-controlled query/object data and invokes the vulnerable code path, a crafted input could terminate the process or disrupt the archiving workflow. The skill's context lowers overall severity somewhat because it appears to be a local content-saving utility rather than an exposed network service, but user-supplied article metadata or parameters could still trigger a denial of service.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.