ClawHub
Back to skill

Security audit

Baoyu Post To Wechat

Security checks for vulnerabilities and agentic risk

Overview

This WeChat publishing skill is mostly coherent, but it includes high-impact login, credential, network, and runtime behaviors that need review before use.

Install only if you trust the publisher and the article inputs. Avoid enabling Telegram QR forwarding unless you fully control the bot and chat, do not process untrusted Markdown or image URLs, prefer a preinstalled trusted Bun runtime over `npx -y bun`, and store WeChat AppSecrets in a protected secret store or locked-down local file.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/wechat-image-loader.ts:33
Finding

Arbitrary URL and Local File Loading Through Image Sources

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
scripts/wechat-article.ts:189
Finding

Mutable Registry Package Execution Through Unpinned npx Bootstrap

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
references/api-setup.md:29
Finding

Plaintext AppSecret Storage Without Mandatory Permission or Version-Control Protection

Content
View full analysis
WECHAT_APP_SECRET= ``` ### Technical Analysis The setup workflow directs the Agent to append a long-lived WeChat AppSecret to a plaintext `.env` file. It does not require restrictive file permissions, secure parent-directory permissions, atomic creation, symlink checks, or version-control exclusions. A project-level `.baoyu-skills/.env` is particularly susceptible to accidental source-control inclusion. An existing file may also inherit permissive permissions. If an attacker can place a symbolic link at the target path, an unsafely implemented append operation could write the credentials to an unintended file. The credential lookup itself is necessary for API publishing, but the setup procedure does not apply the minimum protections expected for long-lived secrets. ### Attack Path 1. API publishing is selected and no credentials are found. 2. The Agent follows the documented setup procedure. 3. The user supplies an AppID and AppSecret. 4. The Agent appends the credentials to a project- or user-level plaintext `.env` file. 5. The file has permissive permissions, is committed to version control, is included in a backup or artifact, or is redirected through a pre-existing symbolic link. 6. Another local user, repository reader, backup recipient, or attacker obtains the AppSecret. ### Impact Assessment Disclosure of the AppSecret can allow unauthorized use of the affected WeChat Official Account API within the permissions and network a ...[truncated 342 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/cdp.ts:49
Finding

Shell Command Injection in WSL Home-Path Conversion

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (133)

YARA rule 'agent_skill_credential_exfiltration_webhook': AI agent skill credential harvesting followed by webhook or external exfiltration [agent_skills]

Critical
Category
YARA Match
Confidence
99% confidence
Finding

The pattern is a strong match because the skill reads externally supplied credentials from environment variables and uses them to send a WeChat login QR to a webhook-like Telegram endpoint. In an agent skill, exfiltration of authentication artifacts through an undisclosed outbound channel is highly dangerous and consistent with credential harvesting behavior.

Content

Scanner excerpt · scripts/wechat-article.ts (reported line 38)May include surrounding context.

ts
tions {
  title: string;
  content?: string;
  htmlFile?: string;
  markdownFile?: string;
  theme?: string;
  color?: string;
  citeStatus?: boolean;
  author?: string;
  summary?: string;
  images?: string[];
  contentImages?: ImageInfo[];
  submit?: boolean;
  profileDir?: string;
  cdpPort?: number;
}

async function sendQrToTelegram(session: ChromeSession): Promise<void> {
  const botToken = process.env.TELEGRAM_BOT_TOKEN;
  const chatId = process.env.TELEGRAM_CHAT_ID;
  if (!botToken || !chatId) return;

  // Wait for QR to render before extracting
  await sleep(2000);

  try {
    // Try to extract QR image from DOM first (avoids full-page screenshot noise)
    const domResult = await session.cdp.send<{ result: { value: string } }>('Runtime.evaluate', {
      expression: `
        (function() {
          const selectors = [
            '.login__type__container__scan img',
            '.login_img img',
            '#login_container img',
            '.qrcode img',
            'im

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The troubleshooting section says a WeChat login QR image can be sent to Telegram using TELEGRAM_BOT_TOKEN and TELEGRAM_CHAT_ID. Forwarding authentication QR codes to a third-party service is an external transmission of a login artifact that could let anyone with Telegram access hijack the WeChat session.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The troubleshooting section says a WeChat login QR image can be sent to Telegram using TELEGRAM_BOT_TOKEN and TELEGRAM_CHAT_ID. Forwarding authentication QR codes to a third-party service is an external transmission of a login artifact that could let anyone with Telegram access hijack the WeChat session.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The troubleshooting section says a WeChat login QR image can be sent to Telegram using TELEGRAM_BOT_TOKEN and TELEGRAM_CHAT_ID. Forwarding authentication QR codes to a third-party service is an external transmission of a login artifact that could let anyone with Telegram access hijack the WeChat session.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The troubleshooting section says a WeChat login QR image can be sent to Telegram using TELEGRAM_BOT_TOKEN and TELEGRAM_CHAT_ID. Forwarding authentication QR codes to a third-party service is an external transmission of a login artifact that could let anyone with Telegram access hijack the WeChat session.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The troubleshooting section says a WeChat login QR image can be sent to Telegram using TELEGRAM_BOT_TOKEN and TELEGRAM_CHAT_ID. Forwarding authentication QR codes to a third-party service is an external transmission of a login artifact that could let anyone with Telegram access hijack the WeChat session.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The troubleshooting section says a WeChat login QR image can be sent to Telegram using TELEGRAM_BOT_TOKEN and TELEGRAM_CHAT_ID. Forwarding authentication QR codes to a third-party service is an external transmission of a login artifact that could let anyone with Telegram access hijack the WeChat session.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

The troubleshooting section says a WeChat login QR image can be sent to Telegram using TELEGRAM_BOT_TOKEN and TELEGRAM_CHAT_ID. Forwarding authentication QR codes to a third-party service is an external transmission of a login artifact that could let anyone with Telegram access hijack the WeChat session.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The troubleshooting section says a WeChat login QR image can be sent to Telegram using TELEGRAM_BOT_TOKEN and TELEGRAM_CHAT_ID. Forwarding authentication QR codes to a third-party service is an external transmission of a login artifact that could let anyone with Telegram access hijack the WeChat session.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The troubleshooting section says a WeChat login QR image can be sent to Telegram using TELEGRAM_BOT_TOKEN and TELEGRAM_CHAT_ID. Forwarding authentication QR codes to a third-party service is an external transmission of a login artifact that could let anyone with Telegram access hijack the WeChat session.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md
| `scripts/wechat-article.ts` | Article posting via browser (文章) |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

md
| `scripts/wechat-api.ts` | Article posting via API (文章) |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

md
| `scripts/md-to-wechat.ts` | Markdown → WeChat-ready HTML with image placeholders |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

md
| `scripts/check-permissions.ts` | Verify environment & permissions |

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

md
# remote_publish_host: server.example.com
# remote_publish_user: deploy
# remote_publish_port: 22
# remote_publish_identity_file: ~/.ssh/id_ed25519
# remote_publish_known_hosts_file: ~/.ssh/known_hosts
# remote_publish_strict_host_key_checking: accept-new
# remote_publish_connect_timeout: 10

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

md
# remote_publish_user: deploy
# remote_publish_port: 22
# remote_publish_identity_file: ~/.ssh/id_ed25519
# remote_publish_known_hosts_file: ~/.ssh/known_hosts
# remote_publish_strict_host_key_checking: accept-new
# remote_publish_connect_timeout: 10
# remote_publish_proxy_jump: bastion.example.com

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

The skill workflow includes guided setup and use of API credentials and access tokens, which are sensitive secrets, but the permissions model is not narrowly declared and storage is only loosely described as .baoyu-skills/.env. In this context, credential handling is high impact because compromise would allow unauthorized publication or account abuse.

Content

Scanner excerpt · SKILL.md (reported line 274)May include surrounding context.

md
| Issue | Fix |
|-------|-----|
| Missing API credentials | Follow guided setup in Step 2 |
| Access token error | Verify credentials valid and not expired |
| Not logged in (browser) | First run opens browser — scan QR to log in. Set `TELEGRAM_BOT_TOKEN` + `TELEGRAM_CHAT_ID` to receive the QR image via Telegram |
| Chrome not found | Set `WECHAT_BROWSER_CHROME_PATH` |
| Title/summary missing | Use auto-generation or provide manually |

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api-setup.md (reported line 28)May include surrounding context.

  1. Copy AppID and AppSecret

Where to save? A) Project-level: .baoyu-skills/.env (this project only) B) User-level: ~/.baoyu-skills/.env (all projects)

text

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api-setup.md (reported line 29)May include surrounding context.

  1. Copy AppID and AppSecret

Where to save? A) Project-level: .baoyu-skills/.env (this project only) B) User-level: ~/.baoyu-skills/.env (all projects)

text

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/multi-account.md (reported line 71)May include surrounding context.

  1. Copy AppID and AppSecret

Where to save? A) Project-level: .baoyu-skills/.env (this project only) B) User-level: ~/.baoyu-skills/.env (all projects)

text

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/wechat-api.ts (reported line 518)May include surrounding context.

ts
3. Copy AppID and AppSecret

Where to save?
A) Project-level: .baoyu-skills/.env (this project only)
B) User-level: ~/.baoyu-skills/.env (all projects)
```

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/wechat-api.ts (reported line 519)May include surrounding context.

ts
3. Copy AppID and AppSecret

Where to save?
A) Project-level: .baoyu-skills/.env (this project only)
B) User-level: ~/.baoyu-skills/.env (all projects)
```

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/wechat-extend-config.test.ts (reported line 306)May include surrounding context.

ts
3. Copy AppID and AppSecret

Where to save?
A) Project-level: .baoyu-skills/.env (this project only)
B) User-level: ~/.baoyu-skills/.env (all projects)
```

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/wechat-extend-config.ts (reported line 353)May include surrounding context.

ts
3. Copy AppID and AppSecret

Where to save?
A) Project-level: .baoyu-skills/.env (this project only)
B) User-level: ~/.baoyu-skills/.env (all projects)
```

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/wechat-extend-config.ts (reported line 381)May include surrounding context.

ts
3. Copy AppID and AppSecret

Where to save?
A) Project-level: .baoyu-skills/.env (this project only)
B) User-level: ~/.baoyu-skills/.env (all projects)
```

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/cdp.ts:51

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/copy-to-clipboard.ts:62

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/paste-from-clipboard.ts:107

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/wechat-api.ts:441

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/wechat-article.ts:443

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/wechat-remote-publish.ts:185

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/wechat-article.ts:38