Security audit

微信连接

Security checks for vulnerabilities and agentic risk

Overview

This skill appears purpose-aligned for installing and pairing WeChat, but it performs persistent account writes, configuration changes, package installation, and a background gateway restart with limited user control.

Review this before installing if you are comfortable with an automatic npm-based plugin install, saving a WeChat bot token locally, changing OpenClaw channel settings, and restarting the OpenClaw gateway. Prefer running it only when you intentionally want to install and pair the WeChat plugin, and verify the package source/version if your environment is sensitive.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Description-Behavior Mismatch

High

Confidence: 92% confidence
Finding: The skill metadata says no command-line interaction is required, but the code uses execSync to inspect configuration, installs a package via npx, modifies OpenClaw config, and later restarts the gateway. This mismatch is security-relevant because it hides privileged system changes behind a seemingly simple QR pairing flow, reducing informed user consent and increasing the chance of unexpected package installation or service disruption.

Context-Inappropriate Capability

Medium

Confidence: 86% confidence
Finding: The script executes shell commands and spawns a detached restart process, which gives it broader system-side effects than a QR display and polling workflow strictly requires. Even though command strings are mostly fixed, this expands the attack surface through package execution, config mutation, and background process control, especially if the environment or called binaries are compromised.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger phrases are broad and include natural-language variants like '装一下微信', which raises the chance of accidental invocation for a skill that can install software, modify configuration, write account files, and restart services. In this context, unintended activation is more dangerous than usual because the skill performs privileged side effects without a clearly documented confirmation gate.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill documentation describes automatic installation, direct writes to ~/.openclaw/openclaw-weixin/accounts/*.json and accounts.json, configuration mutations, and an automatic gateway restart, but does not present these as explicit user-facing warnings or require consent. This is dangerous because users may trigger the skill expecting a QR pairing flow while the skill also changes local state and service behavior in ways that persist beyond the session.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill restarts the OpenClaw gateway in the background after saving credentials, but the restart is not clearly disclosed as a separate action requiring user approval before it occurs. Unexpected service restarts can interrupt running workloads, alter system state, and make a benign-looking pairing action perform operational changes the user did not knowingly authorize.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/start.mjs:59