Wechat Automation

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:26 AM UTC
• Version: 0.3.0

Overview

The skill is mostly a WeChat message sender, but its setup and test instructions can expose webhook keys and ask users to run high-privilege remote installer commands.

Review before installing. Use a pinned ClawHub version, avoid running the documented `curl | sudo bash` Node.js setup command, keep webhook keys out of command-line arguments and logs, and treat all sent message content as leaving your local environment for Enterprise WeChat. Rotate any webhook key that was printed or used in shared terminal/CI output.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SETUP-GUIDE.md:115

Finding

Remote installation script is executed with elevated privileges without integrity verification

Content

View full analysis

Vulnerability Details

File Location: SETUP-GUIDE.md:115-117
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable code:

bash

# Install Node.js
curl -fsSL https://deb.nodesource.com/setup_18.x | sudo -E bash -
sudo apt-get install -y nodejs

Technical Analysis

The setup guide pipes content retrieved from an external URL directly into a privileged shell. The retrieved script is mutable and is not authenticated through a pinned checksum, signature, or vendored copy.

HTTPS protects the connection in transit but does not protect against a compromised upstream server, compromised publishing infrastructure, malicious changes to the hosted script, or an incorrectly trusted certificate authority. Because sudo -E bash executes the response as root and preserves the caller's environment, any commands returned by the remote endpoint receive unrestricted system privileges.

Attack Path

1. A user follows the documented development-environment setup process.
2. The user runs the documented curl ... | sudo -E bash - command.
3. The NodeSource endpoint, its publishing account, DNS resolution, or the user's TLS trust path is compromised.
4. The response contains attacker-controlled shell commands rather than the expected repository setup script.
5. The commands are immediately passed to Bash without review or integrity verification.
6. The payload executes as root and can install services, alter system binaries, access local credentials, or establish persistence.

Impact Assessment

Successful exploitation provides arbitrary command execution as root on the machine following the guide. The compromise is not confined to this package: it can affect all users, files, credentials, services, and network-accessible resources available from the host. An attacker could also establish system persistence or tamper with development artifacts produced on the affected mac ...[truncated 5 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the curl | sudo bash installation pattern.
• Prefer Node.js packages supplied by the operating system or a trusted package manager whose repository metadata and packages are cryptographically verified.
• If an upstream setup script is unavoidable, download a versioned artifact separately, verify a vendor-published cryptographic signature or pinned SHA-256 digest, inspect it, and only then execute it.
• Avoid preserving the caller's environment when elevating privileges unless specific variables are required and explicitly allowlisted.
• Pin the documented Node.js release and repository configuration rather than relying on mutable setup content.
• Run installation steps with the minimum privileges needed and document the expected files and repository changes.

T08 · Insecure Dependencies

Warning

• Location: README.md:9

Finding

Installation instructions execute an unpinned latest package release

Content

View full analysis

Vulnerability Details

File Location: README.md:9-10
Vulnerability Type: Insecure third-party dependency execution
Risk Level: Medium

Vulnerable code:

bash

npx clawhub@latest install wechat-automation

The same mutable installation command also appears in SKILL.md:14-15.

Technical Analysis

The documented installation flow instructs npx to resolve and execute the latest release of clawhub. The effective code executed by this command can therefore change after this skill has been reviewed. No exact version, package-lock integrity value, digest, or signature is specified.

A malicious future release, compromised publisher account, or compromised package-distribution path could cause users to execute attacker-controlled lifecycle scripts or package code. This is a supply-chain risk because review of the current skill does not establish what the mutable latest package will execute during a later installation.

Attack Path

1. A user copies the installation command from the README or skill documentation.
2. npx resolves the package version associated with the mutable latest tag.
3. An attacker compromises the package publisher or causes a malicious release to become latest.
4. npx downloads and executes that release.
5. Malicious package code runs with the privileges of the user performing the installation and can access that user's files, credentials, and environment.

Impact Assessment

Exploitation permits arbitrary code execution as the installing user. The accessible scope may include source repositories, SSH keys, package-registry tokens, cloud credentials, agent configuration, and other files owned by that user. If the command is run from an elevated administrative shell, the resulting impact may extend to full host compromise.

Remediation

View remediation

Remediation Suggestions

• Replace @latest with an exact, reviewed version, such as clawhub@X.Y.Z.
• Maintain a lockfile or equivalent integrity metadata where the installation workflow supports it.
• Verify package provenance and signatures when supported by the registry.
• Review release contents and lifecycle scripts before updating the pinned version.
• Apply the same correction to SKILL.md:14-15 so all installation instructions are consistent.
• Advise users not to run the installation command with administrative privileges.

T09 · Insecure Skill Coding Practices

Warning

• Location: test-webhook.sh:5

Finding

Webhook credential is printed in plaintext by the shell test script

Content

View full analysis

Vulnerability Details

File Location: test-webhook.sh:5-9
Vulnerability Type: Sensitive credential disclosure through console output
Risk Level: Medium

Vulnerable code:

bash

WEBHOOK_KEY="${1:-YOUR_WEBHOOK_KEY}"
WEBHOOK_URL="https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=${WEBHOOK_KEY}"

echo "Testing WeChat Webhook..."
echo "URL: $WEBHOOK_URL"

The original status message is localized, but the security-relevant behavior is the direct output of $WEBHOOK_URL, which contains the full webhook key.

Technical Analysis

The webhook key is a bearer credential: possession of it is sufficient to submit messages through the associated enterprise WeChat robot. The script embeds that credential into a URL and then prints the entire URL to standard output.

Console output is commonly retained by terminal scrollback, CI/CD logs, remote-execution systems, support transcripts, shell recording tools, and centralized log collectors. Consequently, a routine connectivity test can persist the credential in systems with a much broader readership and retention period than the intended secret store.

Attack Path

1. A user invokes test-webhook.sh with a real webhook key.
2. The script interpolates the key into WEBHOOK_URL.
3. The script prints the complete URL to standard output.
4. A CI system, terminal recorder, shared log service, or another person with access to the output obtains the key.
5. The observer sends authenticated requests directly to the WeChat webhook endpoint using the disclosed key.

Impact Assessment

An attacker who obtains the key can impersonate the configured robot and submit messages to its associated group within the permissions and rate limits imposed by WeChat. This can support phishing, fraudulent operational alerts, misinformation, spam, and abuse of group-wide notifications. The flaw does not itself provide operating-system privileges or access to messages that ...[truncated 26 chars]

Remediation

View remediation

Remediation Suggestions

• Never print the full webhook URL or key.
• If endpoint diagnostics are necessary, print only the fixed hostname and path, or redact the key to a short non-sensitive suffix.
• Send status output without including request URLs, authorization values, or secret-bearing query parameters.
• Add automated tests that fail when log output contains the supplied key.
• Rotate any real webhook key that has already appeared in shared or retained logs.
• Configure CI and centralized logging systems to redact known webhook-key patterns as defense in depth.

T09 · Insecure Skill Coding Practices

Warning

• Location: index.js:84

Finding

Webhook bearer credential is accepted through command-line arguments

Content

View full analysis

Vulnerability Details

File Location: index.js:84-99
Vulnerability Type: Sensitive credential exposure through process arguments
Risk Level: Medium

Vulnerable code:

javascript

const args = process.argv.slice(2);

// Parse arguments
const options = {};
for (let i = 0; i < args.length; i++) {
  if (args[i] === '--text' && args[i + 1]) {
    options.text = args[++i];
  } else if (args[i] === '--markdown') {
    options.markdown = true;
  } else if (args[i] === '--webhook-key' && args[i + 1]) {
    options.webhookKey = args[++i];
  } else if (args[i] === '--chatid' && args[i + 1]) {
    options.chatid = args[++i];
  }
}

A second affected entry point is test-webhook.js:11-12, which reads the credential from process.argv[2].

Technical Analysis

The CLI accepts the webhook bearer key directly on the command line. Process arguments may be visible to other local processes through process-inspection facilities and are commonly captured by shell history, terminal auditing, job schedulers, CI metadata, diagnostic tooling, or command transcripts.

Although access to another user's process arguments varies by operating-system configuration, shell-history persistence affects the invoking user by default in many environments. The project documentation recommends a configuration command, but the implementation shown here does not retrieve that configuration; it requires the key to be supplied to sendMessage, encouraging users to pass the secret through exposed command arguments.

Attack Path

1. A user runs the CLI with --webhook-key REAL_KEY, or invokes node test-webhook.js REAL_KEY.
2. The key becomes part of the process argument vector and potentially the user's shell history.
3. A local observer, process-monitoring agent, CI log viewer, or later reader of the history file recovers the argument.
4. The observer uses the key as a bearer credent ...[truncated 535 chars]

Remediation

View remediation

Remediation Suggestions

• Remove or strongly discourage --webhook-key for normal operation.
• Read the key from a protected configuration store, secret manager, or environment variable whose value is not echoed.
• If interactive entry is needed, read it from a non-echoing prompt rather than from process.argv.
• Implement the documented wechat.webhook_key configuration lookup and enforce restrictive permissions on its storage.
• Change test-webhook.js to use the same protected credential source.
• Ensure error and debug output never includes the key or complete secret-bearing URL.
• Rotate keys that have previously been entered into shared shells, CI command definitions, or retained command histories.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (22)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · API-RESEARCH.md (reported line 74)May include surrounding context.

🔐 认证方式

Access Token 获取

bash

curl "https://qyapi.weixin.qq.com/cgi-bin/gettoken?corpid=CORPID&corpsecret=CORPSECRET"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · API-RESEARCH.md (reported line 124)May include surrounding context.

🔐 认证方式

Access Token 获取

bash

curl "https://qyapi.weixin.qq.com/cgi-bin/gettoken?corpid=CORPID&corpsecret=CORPSECRET"

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

This is a classic dangerous chaining pattern: curl retrieves remote content and pipes it straight into a privileged shell. In a setup guide context, readers may run it verbatim, making accidental remote code execution with root access highly likely if the upstream source is ever malicious or tampered with.

Content

Scanner excerpt · SETUP-GUIDE.md (reported line 116)May include surrounding context.

sudo apt-get install -y jq

安装 Node.js

curl -fsSL https://deb.nodesource.com/setup_18.x | sudo -E bash - sudo apt-get install -y nodejs

text

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · API-RESEARCH.md (reported line 19)May include surrounding context.

请求示例:

bash

curl -X POST "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "msgtype": "text",

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The README instructs users to run npx clawhub@latest install wechat-automation, which pulls and executes the latest package version at install time rather than a pinned, reviewed release. This creates a supply-chain risk: if the upstream package is compromised or a breaking/malicious release is published, users may execute untrusted code immediately.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README tells users to configure a webhook_key but does not warn that this value is a secret credential that can authorize message sending if exposed. Developers may store it insecurely in shell history, screenshots, shared docs, or source control, enabling unauthorized message spoofing or abuse of the organization’s WeChat bot.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README promotes webhook-based messaging but does not clearly disclose that message contents are transmitted to an external Enterprise WeChat service. Users may unintentionally send sensitive operational, customer, or incident data off-platform without understanding the data-sharing implications.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SETUP-GUIDE.md (reported line 67)May include surrounding context.

bash

# 测试消息发送
curl -X POST "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "msgtype": "text",

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The guide instructs users to place multiple sensitive credentials, including a webhook key and corporate secrets, into a local .env file with only a brief note about not committing it to Git. This is risky because it normalizes storing live secrets in plaintext without guidance on least privilege, secret rotation, access controls, secure sharing, or use of a secret manager.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SETUP-GUIDE.md (reported line 113)May include surrounding context.

可选工具

bash

# 安装 jq (JSON 处理)
sudo apt-get install -y jq

# 安装 Node.js
curl -fsSL https://deb.nodesource.com/setup_18.x | sudo -E bash -

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SETUP-GUIDE.md (reported line 117)May include surrounding context.

可选工具

bash

# 安装 jq (JSON 处理)
sudo apt-get install -y jq

# 安装 Node.js
curl -fsSL https://deb.nodesource.com/setup_18.x | sudo -E bash -

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 99% confidence

Finding

The use of sudo -E bash on content streamed from curl preserves environment variables while executing remote code as root. That combination increases the blast radius of compromise, potentially exposing sensitive environment data and enabling privileged arbitrary command execution.

Content

Scanner excerpt · SETUP-GUIDE.md (reported line 116)May include surrounding context.

sudo apt-get install -y jq

安装 Node.js

curl -fsSL https://deb.nodesource.com/setup_18.x | sudo -E bash - sudo apt-get install -y nodejs

text

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 99% confidence

Finding

The use of sudo -E bash on content streamed from curl preserves environment variables while executing remote code as root. That combination increases the blast radius of compromise, potentially exposing sensitive environment data and enabling privileged arbitrary command execution.

Content

Scanner excerpt · SETUP-GUIDE.md (reported line 116)May include surrounding context.

sudo apt-get install -y jq

安装 Node.js

curl -fsSL https://deb.nodesource.com/setup_18.x | sudo -E bash - sudo apt-get install -y nodejs

text

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The installation command uses npx clawhub@latest, which fetches and executes the latest published package version at runtime rather than a pinned, reviewed version. This creates a supply-chain risk: if the package is compromised, typosquatted, or a malicious update is published, users following the skill instructions may execute attacker-controlled code on their machine.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code contains natural-language strings such as the header, usage instructions, and error messages only in Chinese. That forces a specific language on users without any visible opt-in or justification that the skill is intentionally limited to a Chinese-speaking or region-specific audience.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script prints the full webhook URL, which includes the secret key, directly to stdout. This can leak the credential into terminal scrollback, logs, CI job output, shell history capture, or screen recordings, allowing anyone with access to reuse the webhook and send unauthorized messages.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · test-webhook.sh (reported line 13)May include surrounding context.

sh

echo ""

# 发送测试消息
RESPONSE=$(curl -s -X POST "$WEBHOOK_URL" \
  -H "Content-Type: application/json" \
  -d '{
    "msgtype": "text",

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

A file-wide natural-language constraint appears here because all headings and instructions are presented only in Chinese, which can amount to forcing a specific language absent user opt-in. The document does not indicate that the skill or notes are restricted to a Chinese-speaking or China-specific audience.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This markdown file includes concrete webhook POST examples and later shows token retrieval using corporate credentials, which are behaviors that affect privacy/system boundaries by sending data to an external service. While the notes mention token security at L133, they do not clearly warn readers near the examples that message content and identifiers are transmitted off-system to WeCom servers.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The natural-language description forces a single language presentation for the skill metadata, which can violate language/locale policy when no user opt-in or justification is provided. Nothing in the manifest indicates this skill is intentionally limited to a Chinese-only audience or region-specific use case.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The file's natural-language comments and user-facing console output are written in Chinese and present usage/instructions only in that language. Under the policy, forcing a specific language without user opt-in can be a locale/language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Comments and runtime messages are presented only in Chinese, which imposes a specific language on users without any opt-in or documented regional justification. Under the language/locale policy, this is a natural-language policy concern unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.