WhatsApp 428 修复

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:57 AM UTC
• Version: 1.0.0

Overview

This skill appears intended to fix WhatsApp connectivity, but its automatic script makes persistent OpenClaw service and installed-code changes with limited safeguards.

Review the script before running it. Only install if you are comfortable with it modifying your OpenClaw installation, adding persistent proxy settings to the gateway service, installing an npm package from the configured registry, and restarting the gateway. Prefer a manual, reversible change or require a dry-run/rollback version first.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: scripts/fix-whatsapp-428.sh:43
• Finding: Unpinned npm Dependency Installation at Runtime## Vulnerability Details **File Location**: `scripts/fix-whatsapp-428.sh`, lines 43–45 **Vulnerability Type**: Supply-chain exposure through an unpinned runtime dependency **Risk Level**: Medium ```bash # 3. Install https-proxy-agent echo "[3/7] Installing https-proxy-agent..." cd "$OPENCLAW_DIR" npm list https-proxy-agent >/dev/null 2>&1 || npm install https-proxy-agent --save ``` ### Technical Analysis The script installs `https-proxy-agent` from the npm registry without specifying an exact version, enforcing a lockfile, validating package integrity, disabling lifecycle scripts, or confirming the registry from which the package will be retrieved. As a result, the code installed by the script can change after the Skill has been reviewed. The effective dependency source may also be influenced by the user's npm configuration. npm installation can execute package lifecycle scripts, so a compromised package release, registry account, registry mirror, or local npm configuration could result in arbitrary code execution. ### Attack Path 1. `https-proxy-agent` is absent from the target OpenClaw installation. 2. An attacker compromises the relevant package release, registry account, configured registry, or registry mirror. 3. The user invokes `fix-whatsapp-428.sh`. 4. The `npm list` command fails because the package is absent. 5. The script executes `npm install https-proxy-agent --save`, resolving a mutable package version from the configured registry. 6. Malicious lifecycle code may execute during installation, or malicious package code may execute when OpenClaw imports the dependency. ### Impact Assessment Exploitation could execute arbitrary code with the permissions of the user running the repair script. The attacker could modify the global OpenClaw installation, access data available to that user, alter OpenClaw runtime behavior, or establish additional user-level persistence. This script does not invoke `sudo` ...[truncated 96 chars]
• Remediation: ## Remediation Suggestions - Pin `https-proxy-agent` to a reviewed exact version. - Maintain and enforce a lockfile with integrity hashes. - Use a controlled installation process such as `npm ci` instead of resolving dependencies dynamically on the target system. - Use `--ignore-scripts` when package lifecycle scripts are not required. - Validate that npm is using an approved HTTPS registry before installing anything. - Prefer including this dependency during a controlled OpenClaw build or deployment rather than modifying a deployed global installation. - Verify the installed package version and integrity before restarting OpenClaw.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/fix-whatsapp-428.sh:86
• Finding: Persistent Process-Wide Redirection of OpenClaw Gateway Traffic## Vulnerability Details **File Location**: `scripts/fix-whatsapp-428.sh`, lines 86–101 **Vulnerability Type**: Overbroad persistent proxy configuration **Risk Level**: Medium ```bash # 6. Check and update systemd service echo "[6/7] Updating systemd service..." if [ -f "$SERVICE_FILE" ]; then cp "$SERVICE_FILE" "$SERVICE_FILE.bak" if grep -q "HTTP_PROXY" "$SERVICE_FILE"; then echo " Existing proxy configuration found, updating..." sed -i "s|HTTP_PROXY=.*|Environment=HTTP_PROXY=http://$LOCAL_IP:$PROXY_PORT|" "$SERVICE_FILE" sed -i "s|HTTPS_PROXY=.*|Environment=HTTPS_PROXY=http://$LOCAL_IP:$PROXY_PORT|" "$SERVICE_FILE" sed -i "s|ALL_PROXY=.*|Environment=ALL_PROXY=http://$LOCAL_IP:$PROXY_PORT|" "$SERVICE_FILE" else echo " Adding proxy configuration..." sed -i '/^\[Service\]/a\ Environment=HTTP_PROXY=http://'"$LOCAL_IP:$PROXY_PORT"'\ Environment=HTTPS_PROXY=http://'"$LOCAL_IP:$PROXY_PORT"'\ Environment=ALL_PROXY=http://'"$LOCAL_IP:$PROXY_PORT"'' "$SERVICE_FILE" fi ``` ### Technical Analysis The Skill is intended to add proxy support for WhatsApp connections, but it writes `HTTP_PROXY`, `HTTPS_PROXY`, and `ALL_PROXY` into the OpenClaw Gateway's systemd service. These are process-wide variables and may affect every Gateway component and child process that honors standard proxy variables, not only the WhatsApp socket. The configuration survives service restarts and user sessions. The script does not verify the identity or trustworthiness of the process listening on the selected proxy address. It also does not obtain confirmation that the user intends unrelated Gateway traffic to use the proxy. TLS still protects HTTPS payloads unless the client trusts an intercepting certificate, but the proxy can observe destinations and connection metadata, block or redirect connections, and inspect or modify plaintext HTTP traffic. ### Attack Pa ...[truncated 1153 chars]
• Remediation: ## Remediation Suggestions - Configure the validated proxy URL only in the WhatsApp account or socket configuration. - Avoid setting process-wide `HTTP_PROXY`, `HTTPS_PROXY`, and `ALL_PROXY` variables for the complete Gateway. - Verify that the configured host and port belong to an expected proxy service before restarting the Gateway. - Require explicit user confirmation before redirecting traffic at service scope. - Use a dedicated systemd drop-in instead of editing the primary service file. - Clearly document which traffic can be affected and provide an automatic rollback command. - Preserve the original configuration safely and restore it if validation or restart fails. - Where supported, configure exclusions through a carefully validated `NO_PROXY` value, although component-specific proxy configuration remains preferable.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/fix-whatsapp-428.sh:7
• Finding: Unvalidated Proxy Port Used in sed Expressions and systemd Configuration## Vulnerability Details **File Location**: `scripts/fix-whatsapp-428.sh`, lines 7 and 89–99 **Vulnerability Type**: Configuration injection and file corruption through unvalidated input **Risk Level**: Medium ```bash PROXY_PORT=${1:-10808} ``` ```bash if grep -q "HTTP_PROXY" "$SERVICE_FILE"; then echo " Existing proxy configuration found, updating..." sed -i "s|HTTP_PROXY=.*|Environment=HTTP_PROXY=http://$LOCAL_IP:$PROXY_PORT|" "$SERVICE_FILE" sed -i "s|HTTPS_PROXY=.*|Environment=HTTPS_PROXY=http://$LOCAL_IP:$PROXY_PORT|" "$SERVICE_FILE" sed -i "s|ALL_PROXY=.*|Environment=ALL_PROXY=http://$LOCAL_IP:$PROXY_PORT|" "$SERVICE_FILE" else echo " Adding proxy configuration..." sed -i '/^\[Service\]/a\ Environment=HTTP_PROXY=http://'"$LOCAL_IP:$PROXY_PORT"'\ Environment=HTTPS_PROXY=http://'"$LOCAL_IP:$PROXY_PORT"'\ Environment=ALL_PROXY=http://'"$LOCAL_IP:$PROXY_PORT"'' "$SERVICE_FILE" fi ``` ### Technical Analysis The first command-line argument is accepted as `PROXY_PORT` without confirming that it is a decimal TCP port in the range 1 through 65535. The value is then interpolated directly into GNU sed programs and into persistent systemd configuration. Shell quoting prevents ordinary shell metacharacters in the argument from being evaluated directly by the shell. However, it does not make the value safe for the downstream sed syntax or systemd configuration format. Sed delimiters, backslashes, and newline characters can alter the generated sed expression, cause commands to fail, corrupt the service file, or inject additional configuration text. Because the script uses `set -e`, malformed input can also leave the installation only partially modified. Exploitation requires an attacker to influence the script argument or persuade a user or automation system to run the script with a crafted value. ### Attack Path 1. An attacker supplies or recommends a crafted proxy-port argumen ...[truncated 1012 chars]
• Remediation: ## Remediation Suggestions - Reject any proxy-port argument that is not composed exclusively of decimal digits. - Convert the value to an integer and enforce the range 1 through 65535. - Exit before modifying any files when validation fails. - Do not build sed programs from untrusted input. - Generate a dedicated systemd drop-in using fixed keys and safely formatted, validated values. - Write the drop-in to a temporary file with restrictive permissions, validate it with `systemd-analyze verify` where available, and then replace the destination atomically. - Reload and restart the service only after all modifications have completed and passed validation. - Automatically restore the previous configuration if verification or restart fails.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (7)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill tells users to execute an opaque shell script from a local path with no disclosure of what it changes, no preview step, and no warning that it may alter service or network configuration. In a security-sensitive troubleshooting skill, this is dangerous because users may blindly run privileged or persistent changes they do not understand, increasing the risk of unintended configuration drift or abuse if the script is modified.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The instructions direct users to modify a systemd user service to add proxy environment variables and then reload and restart the gateway, but they do not warn about service interruption, proxy trust implications, or the persistence of the change. This can disrupt connectivity, reroute traffic through an unintended proxy, and create hard-to-diagnose operational or security issues, especially because the skill derives the proxy host from a local IP placeholder that may be misapplied.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The entire reference is written in Chinese, including the title, problem description, and remediation steps, with no indication that language selection is optional or that the skill is intentionally region-specific. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script performs broad in-place edits to installed application files, changes user systemd proxy settings, and restarts the OpenClaw gateway automatically, all without preview, confirmation, rollback logic, or integrity checks. In this skill context, that is genuinely risky because a user running a 'fix' script may unknowingly alter production behavior, break the installation, or redirect traffic through an unintended proxy.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: Natural-language content across the file is presented exclusively in Chinese, including the skill description and operational steps. Under the language policy, forcing a specific language without opt-in or documented justification is a policy concern.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: All user-facing text in comments and echo statements is written in Chinese, with no indication that the skill is region-specific or that another language can be selected. This can violate language/locale policy when a skill imposes a specific language without user opt-in.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The script installs https-proxy-agent from the network via npm without clearly warning the user that it will perform a network fetch and modify dependencies. While this appears operational rather than malicious, silent package installation increases supply-chain and change-management risk, especially on servers where outbound package installs may violate policy or introduce unexpected code.

Static analysis

No suspicious patterns detected.