Security audit

Weixin Runtime Fix

Security checks for vulnerabilities and agentic risk

Overview

This skill is purpose-aligned but should be reviewed because its installer persistently edits an installed messaging plugin with weak validation and rollback safeguards.

Install only if you understand that it directly edits your local OpenClaw Weixin plugin. Review install.sh first, keep a separate copy of the original plugin files, and avoid running it on any plugin version other than the stated @tencent-weixin/openclaw-weixin@2.4.1 without manual verification.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: install.sh:43
Finding: Quoted heredoc prevents target-path expansion and leaves a partial installation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: install.sh:24
Finding: Backup files are silently overwritten before patch compatibility is established
Content: View full analysis
/dev/null || true cp "$MONITOR_JS" "$MONITOR_JS.bak" 2>/dev/null || true cp "$API_JS" "$API_JS.bak" 2>/dev/null || true ``` ### Technical Analysis Every execution unconditionally copies the current plugin files over fixed `.bak` paths. Existing backups are overwritten without checking whether the current files are original, already patched, corrupted, or from an unsupported plugin version. The `2>/dev/null || true` construction suppresses all backup errors and forces execution to continue. The installer can therefore modify executable plugin files even when one or more backups were not created successfully. This design conflicts with the documented expectation that the `.bak` files provide recoverable originals. On repeated execution, an original backup can be replaced by an already modified version. Combined with the installer's non-atomic patch sequence, this can eliminate the user's reliable rollback path. ### Attack Path 1. The installer is run for the first time and creates fixed `.bak` files. 2. One or more plugin files are patched. 3. The installer is run again, possibly after an upgrade, partial patch, or prior failure. 4. The original `.bak` files are overwritten with the current modified or incompatible files. 5. A later transformation fails or produces a broken plugin. 6. Restoration from `.bak` does not recover the original working version. 7. The user must reinstall the plugin or recover it from another trusted source. A second failure path occurs when `cp` cannot create a backup due to permissions, storage exhaustion, or another filesystem error. The error is discarded and the script continues to modify the target files without a valid rollback copy. ### Impact Assessment No additional privileges are obtained. The ...[truncated 497 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: install.sh:87
Finding: Overbroad line deletion can corrupt unsupported or changed plugin versions
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README explicitly tells users to execute bash install.sh, which is a system-modifying action, but provides no warning about what the script changes, what privileges it may require, or how to inspect it safely first. In a skill/package context, encouraging direct shell execution increases supply-chain risk because users may run repository code without review.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The comment at L39 says the script will use Python for a complex text replacement in monitor.js. However, the quoted heredoc delimiter at L40 ('PYTHON_SCRIPT') disables shell variable expansion, so the Python code at L43 and L75 uses the literal string "$MONITOR_JS" rather than the actual file path. This directly contradicts the documented intent of modifying monitor.js.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The natural-language instructions and operational guidance are presented only in Chinese, which effectively forces a specific language for users without opt-in. The policy allows locale constraints when they are explicitly justified or optional, but neither is stated here.
Content: No source excerpt is available for this finding.