Wechat Search

• Analyzed: May 12, 2026, 3:40 AM
• Findings: 1
• Version: 1.0.3
• Hash: c9040392f1486daee889ff02f2078efef2e0e8afb6a3d1a09417316b74f077d8
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill uses `subprocess.run` in `wechat_search.py`, `wechat_search_fixed.py`, and `wechat_search_simple.py` to execute external scripts and OpenClaw tools. Specifically, it calls `node /root/.openclaw/workspace/skills/tavily-search/scripts/search.mjs` for Tavily search and `openclaw tool web_fetch` for direct web scraping. While these actions are plausibly aligned with the stated purpose of a multi-layer search strategy and arguments are passed as lists (reducing direct shell injection risk), the use of `subprocess.run` to execute arbitrary external scripts (even if internal to the OpenClaw ecosystem) represents a powerful capability that warrants a 'suspicious' classification due to its inherent risk, without clear evidence of intentional malicious behavior.