T09 · Insecure Skill Coding Practices
Error
- Location
scripts/companion_presence_tick.py:356- Finding
Credential-Bearing WeChat Fallback Allows a Configuration-Controlled Network Destination
- Content
View full analysis
dict: """Fallback for WeChat proactive sends when CLI plugin state lacks contextToken.""" target = str(delivery.get("target") or delivery.get("owner_target") or "").strip() account_id = str(delivery.get("account") or delivery.get("accountId") or "").strip() body_text = str(text or "").strip() if not target: raise RuntimeError("weixin delivery target is required") if not body_text: raise RuntimeError("story text is required") account = load_weixin_account(account_id) context_token = load_weixin_context_token(account_id, target) if not context_token: raise RuntimeError("weixin context token is missing") package_info = load_weixin_package_info() version = str(package_info.get("version") or "0.0.0") app_id = str(package_info.get("ilink_appid") or "bot") base_url = str(account.get("baseUrl") or "https://ilinkai.weixin.qq.com").rstrip("/") + "/" token = str(account.get("token") or "").strip() client_id = f"openclaw-weixin:{int(time.time() * 1000)}-{secrets.token_hex(4)}" payload = { "msg": { "from_user_id": "", "to_user_id": target, "client_id": client_id, "message_type": 2, "message_state": 2, "item_list": [{"type": 1, "text_item": {"text": body_text}}], "context_token": context_token, }, "base_info": { "channel_version": version, "bot_agent": "OpenClaw", }, } raw_body = json.dumps(payload, ensure_ascii=False, separators=(",", ":")).encode("utf-8") req = urllib_request.Request( base_url + "ilink/bot/sendmessage", d ...[truncated 3298 chars]- Remediation
View remediation