微信公众号自动发布器

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:22 AM UTC
• Version: 1.0.0

Overview

The skill is coherent for generating and publishing WeChat articles, but it needs review because user-controlled inputs can reach shell execution and the docs can expose secrets.

Review this skill before installing or using it on a real WeChat account. Do not run it with untrusted article topics, search terms, or filenames until the execSync calls are replaced with argument-array process execution. Do not print or paste .env files or WeChat secrets; use presence-only checks instead. Use a test account and require a clear final confirmation before publishing.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/search.js:12

Finding

OS Command Injection Through Search Query

Content

View full analysis

Vulnerability Details

File Location: scripts/search.js, lines 12-29
Vulnerability Type: OS command injection through unsafe shell interpolation
Risk Level: High

Vulnerable Code

javascript

const query = process.argv[2];
if (!query) {
  console.log('❌ 用法：node search.js "关键词"');
  process.exit(1);
}

const requestBody = {
  query,
  edition: 'standard',
  resource_type_filter: [{ type: 'web', top_k: 10 }],
  search_recency_filter: 'year',
  safe_search: false,
};

try {
  const result = execSync(
    `python3 ~/.openclaw/workspace/skills/baidu-search/scripts/search.py '${JSON.stringify(requestBody)}'`,
    { encoding: 'utf8', env: { ...process.env }, timeout: 30000 }
  );

Technical Analysis

The search query originates from process.argv[2] and is inserted into requestBody. Although JSON.stringify() safely serializes the value as JSON, it does not make the resulting string safe for insertion into a shell command.

The serialized request is enclosed in shell single quotes. A single quote supplied as part of the query can terminate this quoted argument. Shell metacharacters following that quote can then introduce an additional command. For example, a query shaped like the following can alter the shell command structure:

text

keyword'; attacker_command; #

The use of execSync() with a string causes execution through a shell, making shell parsing and command substitution possible. No validation or shell escaping prevents this behavior.

The child process also receives a copy of the complete parent environment through:

javascript

env: { ...process.env }

Consequently, injected commands execute with access to the Agent process environment, potentially including unrelated API keys and publishing credentials.

Attack Path

1. An attacker supplies a crafted article topic or search keyword containing a single quote and shell syntax.
2. The ...[truncated 1194 chars]

Remediation

View remediation

Remediation Suggestions

Eliminate shell interpretation by using execFileSync() or spawnSync() with a separate argument array:

javascript

const { execFileSync } = require('child_process');
const os = require('os');

const searchScript = path.join(
  os.homedir(),
  '.openclaw',
  'workspace',
  'skills',
  'baidu-search',
  'scripts',
  'search.py'
);

const result = execFileSync(
  'python3',
  [searchScript, JSON.stringify(requestBody)],
  {
    encoding: 'utf8',
    timeout: 30000,
    env: {
      PATH: process.env.PATH,
      BAIDU_API_KEY: process.env.BAIDU_API_KEY,
    },
  }
);

Additional hardening should include:

• Apply a reasonable maximum length to the query.
• Reject control characters such as null bytes and line breaks when they are unnecessary.
• Pass only the environment variables required by the search dependency.
• Avoid attempting to fix this solely with manual shell escaping; argument-array execution is safer.
• Log failures without including credentials or complete environment data.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/publish.js:13

Finding

OS Command Injection Through Article Filename

Content

View full analysis

Vulnerability Details

File Location: scripts/publish.js, lines 13-14 and 34-42
Vulnerability Type: OS command injection through unsafe filename interpolation
Risk Level: High

Vulnerable Code

javascript

const articleFile = process.argv[2];
if (!articleFile || !fs.existsSync(articleFile)) {
  console.log('❌ 用法：node publish.js article.md');
  process.exit(1);
}

// ...

const publishScript = path.join(__dirname, '../../wechat-toolkit/scripts/publisher/publish.js');
if (fs.existsSync(publishScript)) {
  try {
    execSync(`node "${publishScript}" "${articleFile}"`, {
      encoding: 'utf8',
      env: { ...process.env },
      stdio: 'inherit',
    });
    console.log('\n✅ 发布完成！');

Technical Analysis

The article path comes directly from process.argv[2]. The script verifies that the path exists, but existence checking does not establish that a filename is safe to place in a shell command.

The filename is interpolated into a double-quoted shell argument. On Unix-like systems, filenames may contain double quotes, dollar signs, backticks, parentheses, semicolons, and other shell-significant characters. In addition, command substitution such as $(...) remains active inside shell double quotes.

Therefore, an attacker who can create or select a specially named article file can cause the shell to execute embedded syntax when publishing begins. Quoting the value with double quotes is insufficient because the value itself is not escaped, and a string-based execSync() invocation still invokes shell parsing.

As with the search script, the publisher receives the complete parent environment:

javascript

env: { ...process.env }

This potentially exposes all Agent credentials to both injected commands and the external publishing toolkit.

Attack Path

1. An attacker creates a valid Markdown article whose filename contains shell command-substitution syntax or an em ...[truncated 1356 chars]

Remediation

View remediation

Remediation Suggestions

Use an argument-array API so the filename is never parsed by a shell:

javascript

const { execFileSync } = require('child_process');

execFileSync(
  process.execPath,
  [publishScript, articleFile],
  {
    encoding: 'utf8',
    stdio: 'inherit',
    env: {
      PATH: process.env.PATH,
      WECHAT_APP_ID: process.env.WECHAT_APP_ID,
      WECHAT_APP_SECRET: process.env.WECHAT_APP_SECRET,
    },
  }
);

Apply the following additional controls:

• Resolve the article path with fs.realpathSync() before use.
• Require the resolved path to remain inside an approved article directory.
• Verify that the target is a regular file rather than a directory, device, or unexpected symbolic link.
• Restrict accepted extensions to .md or another explicitly supported format.
• Replace the loose regular-expression checks with a frontmatter parser and validate the parsed schema.
• Pass only the WeChat credentials and environment values required by the publisher.
• Do not rely on character blacklists or shell escaping when argument-array execution is available.

T09 · Insecure Skill Coding Practices

Warning

• Location: README.en.md:303

Finding

Troubleshooting Instructions Expose Complete Credential Files

Content

View full analysis

Vulnerability Details

File Location: README.en.md, lines 303-313; duplicated in README.md, lines 303-313
Vulnerability Type: Plaintext secret disclosure through unsafe diagnostic guidance
Risk Level: Medium

Vulnerable Code

bash

# Check API Key (unified config)
cat ~/.openclaw/.env

# Or check Skill directory config
cat ~/.openclaw/workspace/skills/wanx-image-generator/.env

# Test generation
cd ~/.openclaw/workspace/skills/wanx-image-generator
uv run scripts/generate.py --prompt "test" --output test.png --model wan2.6-t2i

The equivalent Chinese documentation contains the same commands:

bash

# 检查 API Key 配置（统一配置文件）
cat ~/.openclaw/.env

# 或检查 Skill 目录配置
cat ~/.openclaw/workspace/skills/wanx-image-generator/.env

Technical Analysis

The troubleshooting procedure tells users or an automated Agent to print complete .env files. The unified file at ~/.openclaw/.env may hold credentials for multiple Skills, while troubleshooting Wanx image generation only requires determining whether DASHSCOPE_API_KEY is configured.

Printing the complete file exceeds the minimum privilege and information access needed for the declared functionality. Secret values may be exposed through:

• Terminal output and scrollback.
• Agent tool-call results and conversation transcripts.
• Centralized execution logs.
• Screen sharing or support sessions.
• CI/CD logs if the instructions are used in automation.

The project does not directly upload these files, and no deliberate secret-exfiltration endpoint was found. The risk is accidental disclosure caused by the documented diagnostic behavior.

Attack Path

1. Wanx image generation fails or appears misconfigured.
2. A user or Agent follows the documented troubleshooting instructions.
3. cat ~/.openclaw/.env prints every secret stored in the shared OpenClaw configuration.
4. The values become part of terminal output, Agent ...[truncated 723 chars]

Remediation

View remediation

Remediation Suggestions

Replace commands that print credential values with presence-only checks:

bash

if grep -q '^DASHSCOPE_API_KEY=' ~/.openclaw/.env; then
  echo "DASHSCOPE_API_KEY is configured"
else
  echo "DASHSCOPE_API_KEY is not configured"
fi

For a Skill-specific file:

bash

if grep -q '^DASHSCOPE_API_KEY=' \
  ~/.openclaw/workspace/skills/wanx-image-generator/.env; then
  echo "DASHSCOPE_API_KEY is configured"
else
  echo "DASHSCOPE_API_KEY is not configured"
fi

Additional hardening should include:

• Never print complete .env files in troubleshooting procedures.
• Prefer a dedicated Wanx credential store over a shared file containing all Skill secrets.
• Restrict secret-file permissions, for example to owner read/write only.
• Ensure diagnostic tools redact key values automatically.
• Instruct users to rotate any credential that has already appeared in logs or chat transcripts.
• Avoid commands such as echo $WECHAT_APP_SECRET, which similarly disclose the complete secret value; provide a presence-only check instead.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (51)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The troubleshooting instructions explicitly tell the user to run cat ~/.openclaw/.env, which prints secrets to the terminal and potentially to logs, transcripts, screenshots, or agent-visible output. Exposing entire secret files during troubleshooting creates unnecessary credential disclosure risk even if exfiltration is not the intent.

Content

Scanner excerpt · README.en.md (reported line 306)May include surrounding context.

Solution:

bash

# Check API Key (unified config)
cat ~/.openclaw/.env

# Or check Skill directory config
cat ~/.openclaw/workspace/skills/wanx-image-generator/.env

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

This instruction tells the user to print the skill-directory .env file contents, again risking disclosure of API keys in shell history, shared terminals, support logs, or captured agent context. In a tool ecosystem where assistants may observe command output, this materially increases credential exposure risk.

Content

Scanner excerpt · README.en.md (reported line 309)May include surrounding context.

md

cat ~/.openclaw/.env

# Or check Skill directory config
cat ~/.openclaw/workspace/skills/wanx-image-generator/.env

# Test generation
cd ~/.openclaw/workspace/skills/wanx-image-generator

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.en.md (reported line 24)May include surrounding context.

bash

# 推荐：统一配置文件
vim ~/.openclaw/.env

# 添加配置
DASHSCOPE_API_KEY="sk-xxx"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.en.md (reported line 188)May include surrounding context.

bash

# 推荐：统一配置文件
vim ~/.openclaw/.env

# 添加配置
DASHSCOPE_API_KEY="sk-xxx"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.en.md (reported line 194)May include surrounding context.

bash

# 推荐：统一配置文件
vim ~/.openclaw/.env

# 添加配置
DASHSCOPE_API_KEY="sk-xxx"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.en.md (reported line 203)May include surrounding context.

bash

# 推荐：统一配置文件
vim ~/.openclaw/.env

# 添加配置
DASHSCOPE_API_KEY="sk-xxx"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.en.md (reported line 355)May include surrounding context.

bash

# 推荐：统一配置文件
vim ~/.openclaw/.env

# 添加配置
DASHSCOPE_API_KEY="sk-xxx"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 24)May include surrounding context.

bash

# 推荐：统一配置文件
vim ~/.openclaw/.env

# 添加配置
DASHSCOPE_API_KEY="sk-xxx"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 188)May include surrounding context.

bash

# 推荐：统一配置文件
vim ~/.openclaw/.env

# 添加配置
DASHSCOPE_API_KEY="sk-xxx"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 192)May include surrounding context.

bash

# 推荐：统一配置文件
vim ~/.openclaw/.env

# 添加配置
DASHSCOPE_API_KEY="sk-xxx"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 194)May include surrounding context.

bash

# 推荐：统一配置文件
vim ~/.openclaw/.env

# 添加配置
DASHSCOPE_API_KEY="sk-xxx"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 206)May include surrounding context.

bash

# 推荐：统一配置文件
vim ~/.openclaw/.env

# 添加配置
DASHSCOPE_API_KEY="sk-xxx"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 355)May include surrounding context.

bash

# 推荐：统一配置文件
vim ~/.openclaw/.env

# 添加配置
DASHSCOPE_API_KEY="sk-xxx"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · examples/article.md (reported line 184)May include surrounding context.

bash

# 推荐：统一配置文件
vim ~/.openclaw/.env

# 添加配置
DASHSCOPE_API_KEY="sk-xxx"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 78% confidence

Finding

The troubleshooting instructions advise users to run commands that print secret-bearing .env files directly to the terminal. In agent-driven or logged environments, this can expose API keys in transcripts, logs, screen recordings, or shared consoles, turning routine debugging into credential disclosure.

Content

Scanner excerpt · README.md (reported line 306)May include surrounding context.

解决：

bash

# 检查 API Key 配置（统一配置文件）
cat ~/.openclaw/.env

# 或检查 Skill 目录配置
cat ~/.openclaw/workspace/skills/wanx-image-generator/.env

Credential Access

High

• Category: Privilege Escalation
• Confidence: 78% confidence

Finding

This line continues the troubleshooting guidance to display a skill-local .env file, which may contain live API keys. In the context of an automation skill operated through an agent interface, encouraging direct display of secret files materially raises the risk of accidental credential leakage to logs or other observers.

Content

Scanner excerpt · README.md (reported line 309)May include surrounding context.

md

cat ~/.openclaw/.env

# 或检查 Skill 目录配置
cat ~/.openclaw/workspace/skills/wanx-image-generator/.env

# 测试生成
cd ~/.openclaw/workspace/skills/wanx-image-generator

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

声明描述的是一个覆盖“选题、写作、发布到微信公众号”的完整自动化能力，但实际代码只是一个本地命令行脚本：接收主题参数、按关键词选择 tutorial/product/general 模板、生成文章框架并保存到本地文件。代码中没有调用任何内容生成模型、没有自动撰写完整技术文章、没有微信公众号 API 交互、没有认证/上传/发布逻辑，也没有选题流程管理。因此其实际行为仅是“生成文章提纲”，与声明的核心能力和范围存在明显不一致。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

声明描述的是一个覆盖选题、写作到发布的完整自动化系统，但提供的代码片段只实现了发布环节的一个包装脚本：校验输入文件是否存在、检查 frontmatter 字段、然后调用外部发布工具。代码没有任何主题生成、文章撰写、编辑、排版规划或流程编排逻辑。因此描述对能力范围有明显夸大，属于描述与实际行为不一致。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

声明描述的是一个内容生产与微信公众号发布自动化技能，核心能力应包括选题、文章撰写、以及发布到微信公众平台等流程。但提供的代码只处理搜索查询：读取命令行参数、构造搜索请求、调用 baidu-search 的 Python 脚本、解析 JSON 并输出标题/摘要/链接。代码中没有任何文章生成、编辑、排版、公众号 API 调用、认证、发布流程或相关触发逻辑。虽然搜索可能是写作流程的辅助步骤，但该代码片段的实际主功能与声明的主要用途明显不符，因此应判定为描述与行为不匹配。

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documented natural-language trigger is broad enough that a user request can initiate a multi-step pipeline culminating in publication without explicit scoping, gating, or confirmation boundaries in the trigger itself. In a skill that can search, generate content, create media, and publish to a real account, ambiguous invocation increases the chance of unintended or overbroad actions.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 89% confidence

Finding

The phrase 'automatically execute the full workflow' indicates autonomous progression across multiple steps, ending in an external side effect: publishing content. Autonomous decision-making is risky here because the system may move from content generation to account action without sufficient human validation of accuracy, policy compliance, or target account impact.

Content

Scanner excerpt · README.en.md (reported line 40)May include surrounding context.

Write an article about "AI automation workflow" and publish to WeChat official account

text

OpenClaw will automatically execute the full workflow:
1. Generate article framework
2. Search for background materials
3. Write article content

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README advertises automatic publication to a WeChat official account but does not prominently warn that generated content may be inaccurate, noncompliant, or posted to a live account with reputational and operational consequences. In this context, lack of disclosure and safety guidance materially increases the risk of accidental harmful publication.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.en.md (reported line 264)May include surrounding context.

Case 1: Technical Tutorial

text

Write a technical tutorial about "React Performance Optimization"

Case 2: Product Introduction

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README presents a natural-language trigger that combines content generation with immediate publication to a public WeChat account. Because the phrase is broad and resembles an ordinary writing request, users may invoke publishing unintentionally, causing unauthorized or premature public posting through the agent's automation flow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README describes the automated flow ending in publication but does not prominently warn that the skill can post publicly to a WeChat account. Missing a clear side-effect warning undermines informed consent and increases the risk of users triggering irreversible publication actions without appreciating the consequence.

Content

No source excerpt is available for this finding.