Security audit

公众号10w+文章

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its stated hot-article reporting purpose, but it under-discloses credential lookup from shell profile files and has an unclear recurring subscription flow.

Install only if you are comfortable giving the skill a Redfox API key and receiving uncurated WeChat article links/content. Provide the key through a scoped environment variable or OpenClaw secret/config, do not let an agent search shell profile files for credentials, and only enable daily subscriptions if the platform clearly shows how to cancel them.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The documentation explicitly instructs the skill to read local shell configuration files such as ~/.zshrc and ~/.bash_profile to obtain an API key if the environment variable is unset. Accessing unrelated local credential stores is not necessary for a skill whose purpose is only to fetch hot WeChat articles, and it creates a path for secret discovery and exfiltration from the host running the agent.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The dataset contains broad uncurated content beyond a simple 'hot WeChat articles' feed, including ads, recruitment posts, medical advice, sexual/intimate material, and promotional copy. In a skill that pushes articles to users, this creates a content-safety and trust risk: users can be exposed to misleading, inappropriate, or policy-sensitive material without filtering, age-gating, or provenance controls.

Missing User Warnings

Low

Confidence: 71% confidence
Finding: The skill promotes a recurring subscription push flow but does not clearly explain how subscription state is stored, how long it persists, or how users can revoke it. This can lead to unwanted ongoing notifications or collection/retention of user preferences without informed consent, which is a privacy and consent problem even if the functionality is not overtly malicious.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The spec describes obtaining credentials from environment variables or shell profile files without any user-facing disclosure that local credentials may be accessed. In an agent context, undocumented access to local config files materially increases the risk of over-collection of secrets and unauthorized use of credentials beyond the skill's stated data-fetching function.

Static analysis

No suspicious patterns detected.