Security audit

wechat-mp-publisher

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to do what it claims, but it handles WeChat publishing credentials and article content through under-secured remote and local workflows that users should review carefully before installing.

Install only if you fully trust and control the remote MCP server. Do not use the provided HTTP example for real credentials; require HTTPS and server authentication, avoid storing secrets in the skill directory or TOOLS.md, pin dependencies, and rotate WeChat credentials if they were placed in shared files or sent to an untrusted endpoint.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (6)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/publish-remote.sh:92
Finding: WeChat Credentials Can Be Transmitted to a Configurable Plaintext HTTP Endpoint
Content: View full analysis
/dev/null) ``` The documented MCP configuration permits plaintext HTTP: ```json { "mcpServers": { "wenyan-mcp": { "name": "公众号远程助手", "transport": "sse", "url": "http://:3000/sse", "headers": { "X-API-Key": "" } } } } ``` ### Technical Analysis The script embeds the reusable WeChat App ID and App Secret in an MCP request sent to the server selected by `MCP_CONFIG_FILE`. The documented configuration uses plaintext HTTP, which provides neither transport confidentiality nor cryptographic server authentication. Accessing the MCP configuration is necessary for the declared remote-publishing function. However, transmitting a reusable WeChat secret to an arbitrary configurable endpoint—particularly over documented plaintext HTTP—exceeds a secure least-privilege design. The remote server receives both publishing credentials and article data, and the script does not validate the URL scheme, hostname, certificate policy, or expected server identity. ### Attack Path 1. A user configures the MCP endpoint using the documented plaintext HTTP example, or an attacker modifies `$HOME/.openclaw/mcp.json`. 2. The user invokes `scripts/publish-remote.sh`. 3. The script reads the WeChat credentials and plac ...[truncated 896 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: scripts/publish.sh:24
Finding: Runtime Execution of an Unpinned npm Package
Content: View full analysis
/dev/null; then WENYAN_CMD="wenyan" elif command -v npx &> /dev/null; then echo -e "${YELLOW}wenyan-cli 未安装，使用 npx 运行...${NC}" WENYAN_CMD="npx @wenyan-md/cli" else echo -e "${RED}❌ wenyan-cli 和 npx 均未安装！${NC}" echo -e "${YELLOW}请安装 Node.js 或手动运行: npm install -g @wenyan-md/cli${NC}" exit 1 fi } ``` The selected command is later executed while publishing: ```bash $WENYAN_CMD publish -f "$file" -t "$theme" -h "$highlight" ``` ### Technical Analysis When a local `wenyan` executable is unavailable, the script invokes `npx @wenyan-md/cli` without a fixed version or integrity constraint. Depending on local npm behavior and cache state, `npx` may download and execute the current registry version at runtime. npm packages can execute JavaScript and lifecycle logic with the invoking user's privileges. The package also runs after WeChat credentials have been exported into the process environment, making those credentials available to the dependency and its descendants. The use of a legitimate third-party package is consistent with the Skill's publishing function, but resolving an unspecified version at execution time leaves the effective code outside the reviewed artifact and permits it to change after the audit. ### Attack Path 1. The expected `wenyan` executable is not installed. 2. An attacker compromises the npm package, a maintainer account, a transitive dependency, or the registry resolution path. 3. The user invokes `scripts/publish.sh`. 4. The script loads and exports WeChat credentials. 5. `npx` retrieves or selects the attacker-controlled package version. 6. Package code executes with the user's privileges and can read c ...[truncated 675 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:15
Finding: Unpinned MCP Client Installation Metadata
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/setup.sh:5
Finding: Legacy Setup Script Scans a General OpenClaw Workspace File for Credentials
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/publish-remote.sh:10
Finding: Credential Configuration File Is Executed as Arbitrary Shell Code
Content: View full analysis
Remediation: View remediation

other

Note

Location: README.md:11
Finding: Documentation Incorrectly Claims Credentials Are Not Stored on Disk
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: This second mismatch finding reinforces that the skill description overstates remote-publishing and compliance features while apparently introducing local file access behavior not clearly disclosed to users. Undisclosed resource access and overstated security properties can mislead operators into approving file reads or trusting a workflow that accesses local sensitive paths beyond what the skill description suggests.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: This second mismatch finding reinforces that the skill description overstates remote-publishing and compliance features while apparently introducing local file access behavior not clearly disclosed to users. Undisclosed resource access and overstated security properties can mislead operators into approving file reads or trusting a workflow that accesses local sensitive paths beyond what the skill description suggests.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/troubleshooting.md (reported line 8)May include surrounding context.
md
使用本远程技能时，**必须将 MCP 服务所在公网 IP** 加入白名单，而**不是**你当前操作机器的 IP。 **为什么？** - 所有的 API 请求（包括获取 Access Token、上传图文、上传素材）都是由 **远程 MCP 服务器** 发起的。 - 你本地的 OpenClaw 只负责发指令给 MCP，不直接与微信交互。 - 即使你在家里用动态 IP 也没关系，只要 MCP 服务器 IP 固定即可。

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README explicitly promotes publishing through a remote HTTP MCP service and states that sensitive credentials are transmitted at runtime, but it does not clearly warn users about trust boundaries, transport security requirements, server-side exposure, or the privacy implications of sending article content and WeChat credentials to a remote system. In this skill context, that omission is materially risky because the core workflow depends on a third-party or separately hosted remote service, so users may assume the setup is safe by default and unknowingly expose secrets or unpublished content.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 96% confidence
Finding: The skill advertises and instructs shell-based actions such as running scripts, copying environment files, editing secrets, and invoking executables, but it does not declare any explicit tool scope or allowed-tools boundary. That omission weakens least-privilege controls and can cause an agent or user to invoke broader shell capability than expected when using the skill.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The publishing guidance does not prominently warn that article bodies, front matter, and potentially related metadata will be transmitted to a remote MCP service. Users may unknowingly send confidential drafts, unpublished material, or embedded secrets to a third-party host, increasing data leakage and privacy risk in a publishing-oriented skill where content transfer is central.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The setup instructions direct users to store WeChat credentials in a plaintext local environment file without a clear warning about secret handling, file permissions, backup exposure, or accidental commits. Because these credentials authorize publishing actions against an official account, compromise could enable account abuse, unauthorized posts, or operational takeover of the publishing pipeline.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The sample MCP configuration uses plain HTTP for a service that may receive API keys, article content, and operational publishing requests, yet it gives no warning about the absence of transport encryption. This creates material risk of credential interception, content tampering, and man-in-the-middle attacks, especially for users publishing from untrusted networks such as cafes or mobile hotspots as described by the skill.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The example content and usage flow encourage one-click publishing and automatic image upload to WeChat, but the file does not warn users that article text, local images, and possibly remote images will be transmitted to an external platform using configured account credentials. This can lead to unintended disclosure of sensitive content or accidental publication, especially because the example is framed as a simple test workflow that may normalize publishing without an explicit confirmation or privacy notice.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The script falls back to running npx @wenyan-md/cli without pinning an exact version, which allows whatever package version is current at execution time to be downloaded and executed. Because this is a publishing skill that handles WeChat credentials in the environment, a compromised, typosquatted, or maliciously updated package could execute arbitrary code and exfiltrate secrets or alter published content.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script's comments and all user-visible echo messages are in Chinese, with no option to select another language. This can violate language or locale policy where skills must not force a specific language unless the choice is explicit or clearly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The user-facing instructions and examples are presented entirely in Chinese, but the file does not indicate that the skill is intentionally region-specific or provide any language/locale opt-in. Per the policy, forcing a specific language without user choice can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The document presents all instructions and troubleshooting content solely in Chinese, which effectively forces a specific language for users. Under the policy, language constraints should either be optional for the user or clearly documented as region-specific and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The top-level comments state the script is for publishing to WeChat and are written as a Chinese-specific description ('远程发布文章到微信公众号'), which indicates a fixed locale/context without offering any language or locale choice. Under the policy rule, forcing a specific language or locale without user opt-in can be a natural-language policy violation unless clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This shell script extracts WECHAT_APP_ID and WECHAT_APP_SECRET from TOOLS.md, which is access to sensitive credentials. Although the script prints status messages, it does not explicitly disclose beforehand that it will read secrets from a local file, and there is no broader user-facing warning in this file beyond the Chinese comments.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.