ClawHub
Back to skill

Security audit

weixinclaw-proactive-push

Security checks for vulnerabilities and agentic risk

Overview

This skill is disclosed as a WeChat push tool, but it can send real messages and files using local WorkBuddy credentials with broad triggers and no required confirmation.

Only install this if you intentionally want an agent to send WeChat messages and attachments through your WorkBuddy ClawBot channel. Review the recipient in settings.json, keep botToken and claw-state cursor files private, avoid disabling sandbox/network controls unless you understand the exposure, and require manual confirmation before sending any message or file.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill clearly instructs the agent to perform outbound network actions to Tencent/WeChat infrastructure and even mentions disabling the sandbox if networking is blocked, yet the finding says no permissions are declared. That creates a real trust and containment problem: users and hosts are not given an explicit permission boundary for a capability that can exfiltrate messages and upload files to an external service.

Vague Triggers

Medium
Confidence
87% confidence
Finding
The description embeds broad trigger phrases such as '给老板发微信' and '发图片给老板', which are natural-language requests a user might make in many contexts. Because this skill performs real-world outbound messaging to a boss's WeChat account, ambiguous triggering can cause unintended invocation, accidental disclosure of text/files, or misuse without a clear confirmation step.

Vague Triggers

Medium
Confidence
89% confidence
Finding
The '何时用' examples are broad, conversational prompts that lack strict boundaries and map directly to sending proactive messages over WeChat. In this context, the danger is higher than a generic fuzzy trigger because the effect is an external communication action to a specific person ('老板'), potentially forwarding sensitive business data or files based on casual user wording.

Static analysis

No suspicious patterns detected.