OpenClaw WeChat Setup

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:10 PM UTC
• Version: 1.0.0

Overview

The skill’s purpose is clear, but it asks users to run a mutable installer and link a personal WeChat account without enough security and privacy detail.

Review this before installing. Use it only on a trusted machine, verify the npm package and resolved version yourself, consider pinning a reviewed version instead of @latest, and understand that scanning the QR code links a WeChat account for ongoing OpenClaw channel access.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:17

Finding

Execution of an Unpinned Third-Party Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 17
Vulnerability Type: Supply-chain risk from mutable dependency execution
Risk Level: Medium

Vulnerable Code

bash

npx -y @tencent-weixin/openclaw-weixin-cli@latest install

Technical Analysis

The setup workflow directs the user to download and immediately execute the @latest version of a third-party npm package. The @latest tag is mutable, so the code executed in the future may differ from the version available when this Skill was audited. The -y option also suppresses the normal installation confirmation.

The package's implementation, version lock, and integrity metadata are not included in the reviewed project. Consequently, this repository cannot constrain or verify the effective code executed by the command. According to the Skill's documentation, that code is expected to detect the local OpenClaw installation, install and enable a plugin, modify OpenClaw configuration, and initiate an account authorization flow.

This finding identifies an unsafe dependency-execution pattern; it does not establish that the named package is currently malicious.

Attack Path

1. An attacker compromises the publisher account, package distribution process, npm registry path, or a future release associated with the package's latest tag.
2. The attacker publishes a modified release and causes @latest to resolve to it.
3. A user follows the Skill and runs the documented npx -y command.
4. npx downloads and executes the attacker-controlled package without an interactive confirmation prompt.
5. The package runs with the invoking user's privileges and can interact with local files, OpenClaw configuration, plugin state, and other resources accessible to that user.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the user running the installation command. The reachable scope may include:

• Reading or modifying files ac ...[truncated 542 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace @latest with an exact, reviewed package version:

   bash

   npx @tencent-weixin/openclaw-weixin-cli@X.Y.Z install
   

2. Do not use -y by default. Preserve the confirmation step so users can inspect the package name and resolved version before execution.

3. Document the expected publisher, registry, package version, and cryptographic integrity information. Verify package provenance through npm provenance attestations or an equivalent trusted mechanism.

4. Review each package update before changing the pinned version. Document relevant security review results and expected configuration or filesystem changes.

5. Where practical, use lockfile-backed installation or distribute auditable, version-locked source rather than relying on a mutable registry tag.

6. Recommend running the installer with the least-privileged account necessary and in a constrained environment. Users should back up OpenClaw configuration before installation and inspect configuration changes afterward.

7. Consider separating package download from execution so the resolved artifact can be inspected and verified before it runs.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The skill instructs users to execute npx ...@latest, which fetches and runs the newest published package version at install time without version pinning. That creates a supply-chain risk: if the package is compromised, typo-squatted, or a malicious update is published, users may immediately execute attacker-controlled code on their local system.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The setup flow links a personal WeChat account and authorizes ongoing channel access, but the instructions do not warn users about privacy, message visibility, account linking, or the sensitivity of scanning the QR code. In this context, omission is security-relevant because users may grant broad access to personal communications without informed consent or understanding of retention and exposure risks.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.