T09 · Insecure Skill Coding Practices
Warning
- Location
send.js:143- Finding
Unvalidated API Base URL Can Receive the Bot Bearer Token
- Content
View full analysis
- Remediation
View remediation
Security audit
Weixinclaw Proactive Push
Security checks for vulnerabilities and agentic risk
Overview
The skill does what it says, but it uses local bot credentials to send real WeChat messages and has insufficient safeguards around where those credentials are sent and what identifiers are logged.
Install only if you intentionally want this agent to send messages and files to the configured WeChat recipient through your local WorkBuddy ClawBot account. Before use, verify ~/.workbuddy/settings.json points baseUrl exactly to the official Weixin iLink endpoint, avoid disabling sandbox broadly, and treat botToken, cursor files, context tokens, message contents, and recipient IDs as sensitive. Prefer adding an explicit confirmation step and redacting the recipient ID from logs before using it in routine workflows.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
send.js:346- Finding
Sensitive Recipient Identifier Is Written to Console Logs
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (15)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md > 本仓库**只含 `SKILL.md` + `send.js`**，接收方用自己的 `settings.json` 即可，无需你提供任何密钥。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md > 本仓库**只含 `SKILL.md` + `send.js`**，接收方用自己的 `settings.json` 即可，无需你提供任何密钥。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md > 本仓库**只含 `SKILL.md` + `send.js`**，接收方用自己的 `settings.json` 即可，无需你提供任何密钥。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md > 本仓库**只含 `SKILL.md` + `send.js`**，接收方用自己的 `settings.json` 即可，无需你提供任何密钥。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md > 本仓库**只含 `SKILL.md` + `send.js`**，接收方用自己的 `settings.json` 即可，无需你提供任何密钥。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md > 本仓库**只含 `SKILL.md` + `send.js`**，接收方用自己的 `settings.json` 即可，无需你提供任何密钥。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md > 本仓库**只含 `SKILL.md` + `send.js`**，接收方用自己的 `settings.json` 即可，无需你提供任何密钥。
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README explicitly promotes proactive sending of text, images, files, and video to a boss's WeChat account, but it does not prominently warn about privacy, consent, or data-sharing implications before use. Because this skill enables outbound transmission over an external messaging channel, users may send sensitive business or personal content without understanding that data is being shared beyond the local environment.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill documents direct network access to external Tencent/Weixin endpoints and even advises disabling the sandbox, but it declares no explicit tool scope or permissions boundary. That increases the chance of unreviewed outbound actions and makes accidental or unauthorized message sending easier if the skill is invoked in the wrong context.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger phrases are broad enough to overlap with ordinary user requests like '给老板发微信' or '发图片给老板', which can cause unintended invocation of a skill that performs real outbound messaging over a connected bot account. In this skill's context, mistaken activation is more dangerous because it can proactively contact a real recipient using locally stored credentials and sensitive identifiers.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The 'when to use' examples are ambiguous and omit scope boundaries, making it easy for the agent to select this skill for generic messaging requests. Because the skill reads local bot credentials and sends outbound messages/files to a boss's WeChat identity, accidental invocation can create privacy, consent, and unauthorized-communication risks.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The usage guidance at L031 says text messages '默认空 context_token，无需激活', presenting no activation requirement. Later, L084-L089 explicitly states that this old conclusion has expired and even empty-token text sends fail with ret:-2 after session expiry, so the earlier instruction actively contradicts the later documented behavior.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
L154 documents the text path as defaulting to an empty token with no cursor or activation needed. But L084-L089 and L214 explain that after session expiry, even text messages with empty token are rejected and require the user to reactivate the bot chat, so this is an active contradiction rather than a mere omission.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
L169 says '文本默认空 context_token 即可', implying that empty-token text sending is sufficient. This conflicts with L084-L089 and the troubleshooting table at L214, which state that after session expiry text sends are also blocked until the user sends a message to reactivate the session.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 72% confidence
- Finding
This markdown file makes a concrete implementation claim about send.js automatically adding a BOM for text-like files. Since the analyzed file is only documentation and no send.js source is provided here, the statement functions as documentation asserting behavior that is not evidenced within this file and may mislead users if inaccurate.
- Content
Static analysis
No suspicious patterns detected.