ClawHub
Back to skill

Security audit

Weibo Microblogging CLI

Security checks for vulnerabilities and agentic risk

Overview

This Weibo skill mostly matches its stated purpose, but it needs review because its CLI can send Weibo secrets to non-Weibo URLs through configurable endpoints and generic calls.

Review before installing. Use only trusted configuration, avoid WEIBO_REST_BASE or WEIBO_OAUTH_BASE overrides with real credentials, and do not allow agents or untrusted prompts to invoke call with absolute URLs. Prefer a patched version that rejects non-Weibo hosts and does not automatically attach WEIBO_ACCESS_TOKEN to generic requests.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/weibo_cli.sh:4
Finding

Configurable API Base URLs Allow Credential Exfiltration

Content
View full analysis

Vulnerability Details

File Location: scripts/weibo_cli.sh:4-5, 149-153, 167-168, 183-187
Vulnerability Type: Unrestricted credential destination / sensitive-data exposure
Risk Level: High

Vulnerable Code

bash
REST_BASE="${WEIBO_REST_BASE:-https://api.weibo.com/2}"
OAUTH_BASE="${WEIBO_OAUTH_BASE:-https://api.weibo.com/oauth2}"
bash
api_request POST "${OAUTH_BASE}/access_token" \
  --data-urlencode "client_id=${WEIBO_APP_KEY}" \
  --data-urlencode "client_secret=${WEIBO_APP_SECRET}" \
  --data-urlencode "grant_type=authorization_code" \
  --data-urlencode "redirect_uri=${redirect_uri}" \
  --data-urlencode "code=${code}"
bash
api_request POST "${OAUTH_BASE}/get_token_info" \
  --data-urlencode "access_token=${token}"
bash
api_request GET "${REST_BASE}/statuses/public_timeline.json" \
  --get \
  --data-urlencode "access_token=${token}" \
  --data-urlencode "count=${count}" \
  --data-urlencode "page=${page}"

The same REST_BASE behavior also affects the user-timeline and topic-search commands.

Technical Analysis

The script permits WEIBO_REST_BASE and WEIBO_OAUTH_BASE to override the documented official Weibo endpoints. It does not validate the resulting scheme, hostname, port, or origin before attaching sensitive credentials.

Consequently, ordinary documented operations may transmit the following secrets to a caller-selected server:

  • WEIBO_APP_SECRET
  • OAuth authorization code
  • WEIBO_ACCESS_TOKEN
  • OAuth and request metadata

This behavior is not necessary for the declared functionality, which identifies https://api.weibo.com as the intended provider. It therefore exceeds the minimum network trust boundary required by the skill. It also permits plaintext HTTP endpoints if an override uses http://.

Attack Path

  1. An attacker gains influence over the process environment, deployment configuration, or an agent- ...[truncated 1154 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove runtime base-URL overrides from production builds and use fixed official endpoints:
    bash
    readonly REST_BASE="https://api.weibo.com/2"
readonly OAUTH_BASE="https://api.weibo.com/oauth2"
  2. If overrides are required for controlled testing, disable them by default and require an explicit test mode that never uses production credentials.
  3. Parse and validate every endpoint before sending secrets:
    • Require HTTPS.
    • Allow only the exact hostname api.weibo.com.
    • Reject embedded credentials, unexpected ports, fragments, and alternate origins.
  4. Add curl --proto '=https' and fail closed when endpoint validation fails.
  5. Ensure credentials are not forwarded across redirects to another origin. Prefer rejecting redirects entirely for OAuth and authenticated API calls.
  6. Add automated tests proving that HTTP URLs, unapproved hosts, deceptive subdomains, and malformed origins are rejected before request execution.
  7. Document any test-only endpoint customization and warn that production secrets must never be used with custom endpoints.

T09 · Insecure Skill Coding Practices

Error
Location
scripts/weibo_cli.sh:235
Finding

Generic Call Command Automatically Sends Access Tokens to Arbitrary URLs

Content
View full analysis

Vulnerability Details

File Location: scripts/weibo_cli.sh:235-265
Vulnerability Type: Arbitrary-destination bearer-token disclosure
Risk Level: High

Vulnerable Code

bash
cmd_call() {
  local method="GET" path="" token="${WEIBO_ACCESS_TOKEN:-}"
  local -a params=()
  while [[ $# -gt 0 ]]; do
    case "$1" in
      --method) method="${2:-}"; shift 2 ;;
      --path) path="${2:-}"; shift 2 ;;
      --param) params+=("${2:-}"); shift 2 ;;
      --access-token) token="${2:-}"; shift 2 ;;
      *) echo "error: unknown option: $1" >&2; exit 1 ;;
    esac
  done
  [[ -z "$path" ]] && { echo "error: --path is required" >&2; exit 1; }

  local url
  if [[ "$path" =~ ^https?:// ]]; then
    url="$path"
  else
    if [[ "$path" == /2/* ]]; then
      url="https://api.weibo.com${path}"
    else
      url="${REST_BASE}/${path#/}"
    fi
  fi

  local -a curl_args=()
  if [[ "$method" == "GET" ]]; then
    curl_args+=(--get)
  fi
  [[ -n "$token" ]] && curl_args+=(--data-urlencode "access_token=${token}")
  for kv in "${params[@]}"; do
    curl_args+=(--data-urlencode "$kv")
  done

  api_request "$method" "$url" "${curl_args[@]}"
}

Technical Analysis

The documented call interface is presented as a way to invoke Weibo /2/... API paths, but the implementation also accepts any absolute HTTP or HTTPS URL. Whenever an access token is present—either through WEIBO_ACCESS_TOKEN or --access-token—the script automatically appends it to the request.

There is no origin allowlist or confirmation before the credential is transmitted. For GET requests, --get places the token in the URL query string, which can additionally expose it through server logs, proxy logs, monitoring systems, and request histories.

Supporting arbitrary external destinations is unnecessary for a Weibo-specific API wrapper and breaks the skill's declared provider ...[truncated 1362 chars]

Remediation
View remediation

Remediation Suggestions

  1. Reject absolute URLs and accept only validated Weibo API paths:
    bash
    [[ "$path" == /2/* ]] || {
  echo "error: only Weibo /2/ API paths are allowed" >&2
  exit 1
}
url="https://api.weibo.com${path}"
  2. Normalize the path and reject traversal, control characters, encoded authority components, and other ambiguous URL forms.
  3. Require HTTPS and the exact api.weibo.com origin for every authenticated request.
  4. Never attach WEIBO_ACCESS_TOKEN automatically to arbitrary destinations.
  5. If an unauthenticated generic HTTP feature is genuinely required, implement it as a separate command that cannot access the token environment variable.
  6. Prefer an authorization header where supported by the provider. If the Weibo endpoint requires a request parameter, avoid GET when possible so credentials do not appear in URLs and logs.
  7. Validate the method against a strict allowlist appropriate to the endpoint rather than forwarding any caller-provided method.
  8. Add regression tests confirming that http://, non-Weibo HTTPS hosts, deceptive subdomains, protocol-relative URLs, and malformed paths are rejected before curl runs.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (20)

Tainted flow: 'api_key' from os.getenv (line 44, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · weibo-brave-search/scripts/weibo_search.py (reported line 51)May include surrounding context.

python
"Provide it through OpenClaw skill config or a secure deployment environment."
        )

    response = requests.get(
        "https://api.search.brave.com/res/v1/web/search",
        headers={"X-Subscription-Token": api_key},
        params={

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · OPENCLAW_SECRETS_REMEDIATION_PLAN.md (reported line 43)May include surrounding context.

md
### Phase 1: Correct the published contract

Update skill metadata and docs so users and automated installers can see the runtime contract before execution.

Actions:

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

This is a clear description-behavior mismatch. The declared purpose centers on official Weibo Open Platform capabilities: OAuth2 auth, token setup, endpoint debugging, timeline retrieval, and structured social monitoring through Weibo's API. The actual code does none of that. It is a standalone fallback search utility that calls Brave Search and searches public pages on weibo.com using a site filter. That is a materially different primary purpose and accesses a different external service than declared. While the script's docstring says it is a fallback when official API access is unavailable, the supplied description does not mention this Brave-based fallback behavior at all.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api_guide.md (reported line 11)May include surrounding context.

md
- API wiki index: https://open.weibo.com/wiki/%E5%BE%AE%E5%8D%9AAPI
- OAuth mechanism: https://open.weibo.com/wiki/%E6%8E%88%E6%9D%83%E6%9C%BA%E5%88%B6
- OAuth authorize: https://open.weibo.com/wiki/OAuth2/authorize
- OAuth access token: https://open.weibo.com/wiki/OAuth2/access_token
- OAuth token info: https://open.weibo.com/wiki/OAuth2/get_token_info

## Base URLs

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill advertises and operationalizes shell, environment-variable, and network-based behavior but does not declare an explicit tool scope such as permissions or allowed-tools. In an agentic environment, this weakens policy enforcement and reviewability, increasing the chance that the skill can access secrets or make outbound requests beyond what operators expected.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api_guide.md (reported line 16)May include surrounding context.

md
#!/usr/bin/env bash
set -euo pipefail

REST_BASE="${WEIBO_REST_BASE:-https://api.weibo.com/2}"
OAUTH_BASE="${WEIBO_OAUTH_BASE:-https://api.weibo.com/oauth2}"

usage() {

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api_guide.md (reported line 17)May include surrounding context.

md
#!/usr/bin/env bash
set -euo pipefail

REST_BASE="${WEIBO_REST_BASE:-https://api.weibo.com/2}"
OAUTH_BASE="${WEIBO_OAUTH_BASE:-https://api.weibo.com/oauth2}"

usage() {

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/weibo_cli.sh (reported line 4)May include surrounding context.

sh
#!/usr/bin/env bash
set -euo pipefail

REST_BASE="${WEIBO_REST_BASE:-https://api.weibo.com/2}"
OAUTH_BASE="${WEIBO_OAUTH_BASE:-https://api.weibo.com/oauth2}"

usage() {

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/weibo_cli.sh (reported line 5)May include surrounding context.

sh
#!/usr/bin/env bash
set -euo pipefail

REST_BASE="${WEIBO_REST_BASE:-https://api.weibo.com/2}"
OAUTH_BASE="${WEIBO_OAUTH_BASE:-https://api.weibo.com/oauth2}"

usage() {

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This code sends the sensitive WEIBO_APP_SECRET value to a remote endpoint as part of the OAuth access-token exchange. While this is functionally expected for OAuth, the script itself provides no user-facing warning, comment, or disclosure that a credential from the environment will be transmitted over the network.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The script sends the access token as a URL query parameter on GET requests. Query parameters are more likely to be logged by shells, proxies, servers, monitoring systems, and browser/history tooling than Authorization headers, increasing the chance of credential leakage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This endpoint also places the bearer token in the request URL query string, which can cause the token to be captured in logs or telemetry outside the script's control. Reuse of leaked tokens could enable unauthorized API access within the token's scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The search-topics command includes the access token in the URL query string, creating the same token exposure risk through intermediary logging and diagnostics. In shared CI, shell history, or proxy environments, this can materially increase the chance of credential compromise.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The generic call command accepts an arbitrary --path, and if it begins with http:// or https:// the script sends the request directly to that external URL. Because it also automatically appends WEIBO_ACCESS_TOKEN when present, this creates an SSRF/data-exfiltration style capability that exceeds the stated Weibo-only scope and can leak credentials or sensitive parameters to attacker-controlled hosts.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The cmd_call logic permits outbound requests to arbitrary destinations unrelated to Weibo, which is not justified by the skill's declared purpose. In an agent/tooling context this broad network primitive is dangerous because user-controlled input can be turned into requests to untrusted infrastructure, potentially leaking access tokens and enabling misuse beyond the integration's intended scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The generic call command combines two risks: it can send arbitrary parameters to arbitrary URLs and will automatically include the access token if available. This makes accidental or malicious exfiltration trivial, especially if an attacker can influence the command arguments or convince a user/agent to target a non-Weibo host.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill metadata says it uses the official Weibo Open Platform, but this script instead queries Brave Search for public weibo.com pages. That mismatch can mislead operators about what data flows, dependencies, and trust boundaries are involved, causing them to grant or deploy capabilities they did not intend.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The script requires a third-party credential, BRAVE_SEARCH_API, that is outside the stated Weibo Open Platform purpose. In an agent-skill environment, undisclosed extra credentials expand the attack surface and can lead to over-privileged deployments or unintended external data sharing.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · weibo-brave-search/SKILL.md (reported line 4)May include surrounding context.

md
)

    response = requests.get(
        "https://api.search.brave.com/res/v1/web/search",
        headers={"X-Subscription-Token": api_key},
        params={
            "q": f"site:weibo.com {keyword}",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · weibo-brave-search/scripts/weibo_search.py (reported line 52)May include surrounding context.

python
)

    response = requests.get(
        "https://api.search.brave.com/res/v1/web/search",
        headers={"X-Subscription-Token": api_key},
        params={
            "q": f"site:weibo.com {keyword}",

Static analysis

No suspicious patterns detected.