ClawHub
Back to skill

Security audit

Wechat Search Release

Security checks for vulnerabilities and agentic risk

Overview

The skill is aimed at public WeChat article search, but its implementation does not enforce important safety claims and may mark deceptive external links as valid WeChat results.

Install only if you are comfortable with external web searches for your queries and the weaker-than-advertised compliance controls. Treat returned URLs as untrusted, avoid sensitive search terms, and prefer a fixed version that validates hostnames exactly, URL-encodes queries, pins dependencies, and either implements or removes the claimed robots.txt/rate-limit/User-Agent guarantees.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
wechat_search.py:137
Finding

Weak WeChat Hostname Validation Permits Deceptive External Links

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
wechat_search.py:21
Finding

Documented Request-Safety Controls Are Loaded but Not Enforced

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Rogue AgentSelf-Modification, Session Persistence
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (14)

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 44)May include surrounding context.

text

## Configuration
Create `~/.openclaw/wechat-search-config.json` to customize behavior:

```json
{

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill describes capabilities that imply network access, shell-style invocation, and local file interaction, but it does not declare any explicit tool scope or permissions boundary. This creates ambiguity about what the agent may use at runtime, increasing the risk of over-privileged execution or unintended access to local resources and external services.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
77% confidence
Finding

The skill instructs users to create a persistent configuration file under ~/.openclaw, which introduces session persistence on the local system. Even though the example appears to store benign settings, persistent local state can retain sensitive values later, such as API keys or behavior overrides, and may be read or modified by other processes if not protected.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

text

## Configuration
Create `~/.openclaw/wechat-search-config.json` to customize behavior:

```json
{

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill forwards user-supplied queries to external services through OpenClaw web_search and web_fetch without any explicit in-file warning, consent, or data-handling notice. If users include sensitive internal terms, credentials, or personal data in queries, that information may be disclosed to third-party services and logs outside the local trust boundary.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · wechat_search.py (reported line 47)May include surrounding context.

python
search_query = f'{query} site:mp.weixin.qq.com'
            
            # Call OpenClaw's web_search tool
            result = subprocess.run([
                'openclaw', 'tool', 'web_search',
                '--query', search_query,
                '--count', str(max_results)

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · wechat_search.py (reported line 71)May include surrounding context.

python
search_url = f"https://weixin.sogou.com/weixin?type=2&query={query}"
            
            # Call OpenClaw's web_fetch tool
            result = subprocess.run([
                'openclaw', 'tool', 'web_fetch',
                '--url', search_url,
                '--extract-mode', 'markdown'

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

This markdown file states that the skill falls back to direct page fetching and web search, which can transmit user queries to external services and websites. While the README explains the mechanism and compliance posture, it does not explicitly disclose this as a user-facing privacy/network behavior to watch for.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
96% confidence
Finding

The dependency is specified with a lower bound only, which allows future installs to resolve to different versions over time. This weakens reproducibility and can unintentionally introduce vulnerable or incompatible releases, especially for a network-facing library like requests.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text
# Core dependencies
requests>=2.25.0
beautifulsoup4>=4.9.0

# Test dependencies

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
93% confidence
Finding

The manifest does not pin requests, and requests has multiple known advisories across its version history, so there is no way to verify that an installed version is safe. In this skill's context, requests is a core runtime dependency used for web search/fetch operations, making dependency uncertainty more significant because vulnerable HTTP handling could affect live network interactions.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

beautifulsoup4 is also unpinned, so builds are not reproducible and may pull in newer versions with unexpected behavior or security issues. While this package is less security-sensitive than an HTTP client, unpinned dependencies still increase supply-chain risk.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text
# Core dependencies
requests>=2.25.0
beautifulsoup4>=4.9.0

# Test dependencies
pytest>=6.0.0

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
88% confidence
Finding

pytest is a test dependency, but leaving it unpinned can still expose CI or development environments to supply-chain or tooling-related issues. The risk is lower than for runtime dependencies because it is not typically shipped in production execution paths.

Content

Scanner excerpt · requirements.txt (reported line 6)May include surrounding context.

text
beautifulsoup4>=4.9.0

# Test dependencies
pytest>=6.0.0
pytest-cov>=2.10.0
mock>=4.0.0

Unverifiable Dependency: pytest has 2 known advisory(ies) (CVE-2025-71176 (pytest has vulnerable tmpdir handling); CVE-2025-71176 (pytest has vulnerable tmpdir handling)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
87% confidence
Finding

pytest-cov is unpinned, which can make CI and test environments non-reproducible and may introduce vulnerable or unstable versions. This is mainly a software supply-chain hygiene issue rather than an immediate application exploit path.

Content

Scanner excerpt · requirements.txt (reported line 7)May include surrounding context.

text
# Test dependencies
pytest>=6.0.0
pytest-cov>=2.10.0
mock>=4.0.0

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
87% confidence
Finding

mock is specified as a minimum version only, so dependency resolution may vary across installations. Although it is a test-only package, unpinned tooling still increases supply-chain uncertainty and can affect CI or developer workstations.

Content

Scanner excerpt · requirements.txt (reported line 8)May include surrounding context.

text
# Test dependencies
pytest>=6.0.0
pytest-cov>=2.10.0
mock>=4.0.0

Static analysis

No suspicious patterns detected.