ClawHub
Back to skill

Security audit

Wechat Content Studio

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed WeChat article production workflow that can create drafts and call external/local publishing tools, with safety checks and no evidence of hidden or malicious behavior.

Install this only if you want an agent to help with the full WeChat Official Account workflow, including cover generation through the LuisClaw relay and creating/verifying WeChat drafts via your local publishing scripts. Confirm prompts and publishing intent before running it, and make sure the local scripts and credentials it depends on are ones you trust.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
88% confidence
Finding
The skill description is broad enough to trigger on ordinary writing, testing, packaging, publishing, or verification requests, which can cause the agent to invoke a high-privilege workflow in situations where the user did not clearly ask for WeChat article operations. Because this skill includes publishing and server-aware actions, overbroad activation increases the chance of unintended content handling or publication-side effects.

Static analysis

No suspicious patterns detected.