Wechat Mp Publisher

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:24 AM UTC
• Version: 2.0.3

Overview

This appears to be a real WeChat publishing skill, but it can publish or delete account content and upload local files without enough safeguards.

Review before installing. Use this only with a WeChat account where the agent is allowed to create, publish, and delete content. Prefer saving drafts first, verify media_id targets before deletion, restrict upload paths to a dedicated media folder, protect the config and token cache with owner-only permissions, and update vulnerable dependencies before using it in production.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: src/media.ts:57

Finding

Unrestricted Local File Upload to WeChat

Content

View full analysis

{ const accessToken = await this.authManager.getAccessToken(); const url = `${WECHAT_API_BASE}/media/upload?access_token=${accessToken}&type=${type}`; const form = new FormData(); form.append('media', fs.createReadStream(filePath)); try { const response = await axios.post(url, form, { headers: form.getHeaders() }); ``` ### Technical Analysis The agent-facing upload operation accepts an arbitrary local path and checks only whether that path exists. It does not: - Restrict files to an approved workspace or media directory. - Resolve and validate the canonical path. - Reject symbolic links. - Verify that the path points to a regular file. - Validate the file's signature, MIME type, extension, or size against the selected media type. The destination is a fixed official WeChat HTTPS endpoint, so this is not hidden third-party exfiltration. However, the filesystem privilege exposed to an agent exceeds the minimum privilege needed to upload ordinary publication assets. Any file readable by the hosting process can be opened and submitted to WeChat, subject to WeChat accepting the uploaded content. ### Attack Path 1. An attacker places malicious ins ...[truncated 1276 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: src/auth.ts:108

Finding

Existing Access-Token Cache Permissions Are Not Tightened

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (44)

Known Vulnerable Dependency: handlebars==4.7.8 — 8 advisory(ies): CVE-2026-33916 (Handlebars.js has Prototype Pollution Leading to XSS through Partial Template In); CVE-2026-33937 (Handlebars.js has JavaScript Injection via AST Type Confusion); CVE-2026-33938 (Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @part) +5 more

Critical

• Category: Supply Chain
• Confidence: 90% confidence

Finding

handlebars 4.7.8 is flagged for multiple prototype pollution and code/script injection issues, but in this lockfile it appears only as a dev-time transitive dependency of ts-jest. That reduces exposure substantially unless CI or tooling compiles attacker-controlled templates or test artifacts, yet it remains a real supply-chain weakness in development environments.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · TECH_SPEC.md (reported line 10)May include surrounding context.

md

## 🎯 功能需求

### 核心功能
1. **微信 API 认证**: 使用 AppID/AppSecret 获取 Access Token
2. **文章素材上传**: 支持上传封面图片、正文图片、视频等
3. **图文消息创建**: 组装图文消息（标题、作者、封面、正文等）
4. **文章发布**: 支持草稿箱保存和群发发布

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · TECH_SPEC.md (reported line 112)May include surrounding context.

md

## 🎯 功能需求

### 核心功能
1. **微信 API 认证**: 使用 AppID/AppSecret 获取 Access Token
2. **文章素材上传**: 支持上传封面图片、正文图片、视频等
3. **图文消息创建**: 组装图文消息（标题、作者、封面、正文等）
4. **文章发布**: 支持草稿箱保存和群发发布

Known Vulnerable Dependency: axios==1.13.6 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

axios is a direct production dependency of this skill, and the reported advisories include SSRF, proxy bypass, and request/response manipulation classes of issues. Because this project appears to publish content remotely and likely makes outbound HTTP requests, a vulnerable HTTP client in the runtime path is materially risky and could enable request redirection, credential leakage, or abuse of internal network access depending on how the skill uses axios.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: brace-expansion==1.1.12 — 4 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-33750 (brace-expansion: Zero-step sequence causes process hang and memory exhaustion); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro) +1 more

High

• Category: Supply Chain
• Confidence: 88% confidence

Finding

brace-expansion 1.1.12 is flagged for multiple denial-of-service conditions involving pathological patterns. Here it is a transitive dev dependency, so the main risk is build/test-time resource exhaustion if attacker-controlled glob or pattern input reaches tooling that relies on it.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: browserslist==4.28.1 — 2 advisory(ies): CVE-2026-73088 (Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.); CVE-2026-73089 (Browserslist: Unbounded memory growth (no cache eviction) via distinct query res)

High

• Category: Supply Chain
• Confidence: 82% confidence

Finding

browserslist is a dev dependency and the advisories describe crash, prototype write, and memory-growth issues from untrusted stats/query input. In this repository the likely exposure is limited to development/build processes, but CI or local tooling could still be disrupted if hostile configuration or stats data is introduced.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

• Category: Supply Chain
• Confidence: 95% confidence

Finding

form-data is a direct production dependency and is flagged for CRLF injection via unescaped multipart field names/filenames. If this skill builds multipart requests from untrusted content or filenames, an attacker could inject malformed multipart boundaries or headers, potentially smuggling content or altering server-side interpretation of uploaded data.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: js-yaml==3.14.2 — 4 advisory(ies): CVE-2026-84375 (js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources); CVE-2026-59869 (js-yaml: YAML merge-key chains can force quadratic CPU consumption); GHSA-5p4m-2wfm-xmqj (JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026) +1 more

High

• Category: Supply Chain
• Confidence: 86% confidence

Finding

js-yaml 3.14.2 is a dev dependency with known CPU exhaustion issues when parsing crafted YAML. This is typically exploitable only if repository-controlled or external YAML is parsed during tests/builds, making it primarily a CI/developer workstation availability risk here.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: picomatch==2.3.1 — 2 advisory(ies): CVE-2026-33672 (Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Mat); CVE-2026-33671 (Picomatch has a ReDoS vulnerability via extglob quantifiers)

High

• Category: Supply Chain
• Confidence: 85% confidence

Finding

picomatch 2.3.1 is flagged for method injection and ReDoS via crafted glob/extglob patterns. In this repository it is primarily used by dev tooling, so the most likely impact is denial of service or misbehavior during file matching in CI/test environments when handling attacker-controlled patterns.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The document promotes tools that can publish articles and delete drafts on a live WeChat public account, but it does not prominently warn users about the irreversible or externally visible effects of these operations. In an agent skill context, missing safety warnings increases the risk of accidental misuse, unintended publication, or destructive actions against real account content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file documents commands that publish articles, upload media, and query drafts against a third-party platform, which can affect user data and privacy. The usage section provides direct execution examples but does not include any warning that article content, media files, and configured credentials will be sent to WeChat APIs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill exposes a destructive delete-draft capability with no documented requirement for user confirmation, preview, or recovery guidance. In an agent setting, this increases the chance of accidental or unauthorized deletion of editorial content, especially if the agent is operating on ambiguous instructions or untrusted prompts.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 81% confidence

Finding

The skill instructs users to persist sensitive long-lived credentials and token cache data under predictable paths in the home directory. While common operationally, this creates a security risk if file permissions are weak, the host is shared, backups are exposed, or other tools/prompts can read local files and extract the WeChat app secret or cached access tokens.

Content

Scanner excerpt · SKILL.md (reported line 183)May include surrounding context.

Configuration

Create a configuration file at ~/.openclaw/config/wechat-mp.json:

json

{

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The spec defines a tool that can immediately publish articles to a public WeChat account, but it does not require an explicit user-facing warning or confirmation for that high-impact action. In an agent context, this increases the risk of accidental mass publication, reputational harm, and unintended disclosure because a simple parameter choice can trigger irreversible external publication.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The deleteDraft method issues a remote deletion request to the WeChat draft API, which is a destructive action. The code includes only internal comments and error handling, but no user-facing confirmation, warning, or logging indicating that a draft will be permanently deleted.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The publishArticle method creates a draft and then immediately publishes it to the external WeChat API, which is a potentially irreversible action affecting user-controlled content. Although comments describe the behavior, there is no user-facing confirmation, logging, or warning at the point of execution to disclose that publication will happen immediately.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This TypeScript file contains natural-language comments and runtime messages such as the module description, error text, and warnings entirely in Chinese. Under the stated policy, forcing a specific language without user opt-in or a documented locale justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · src/index.ts (reported line 70)May include surrounding context.

ts

// 检查配置文件权限
  const permCheck = checkFilePermissions(targetPath);
  if (permCheck.readableByOthers) {
    console.warn(`警告: 配置文件 ${targetPath} 对其他用户可读，建议执行: chmod 600 ${targetPath}`);
  }

  try {

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The delete-draft tool invokes a destructive action via client.article.deleteDraft(params.media_id) and returns success, but this function contains no confirmation prompt, cautionary comment/docstring, or user-facing warning that content will be removed. For a deletion-capable code path, the absence of any disclosure increases the chance of unintended data loss when the skill is invoked.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · TECH_SPEC.md (reported line 114)May include surrounding context.

md

import { AuthManager } from './auth';
import { MediaUploadResponse } from './types';

const WECHAT_API_BASE = 'https://api.weixin.qq.com/cgi-bin';

export type MediaType = 'image' | 'thumb' | 'voice' | 'video';

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · TECH_SPEC.md (reported line 119)May include surrounding context.

md

import { AuthManager } from './auth';
import { MediaUploadResponse } from './types';

const WECHAT_API_BASE = 'https://api.weixin.qq.com/cgi-bin';

export type MediaType = 'image' | 'thumb' | 'voice' | 'video';

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · TECH_SPEC.md (reported line 125)May include surrounding context.

md

import { AuthManager } from './auth';
import { MediaUploadResponse } from './types';

const WECHAT_API_BASE = 'https://api.weixin.qq.com/cgi-bin';

export type MediaType = 'image' | 'thumb' | 'voice' | 'video';

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · TECH_SPEC.md (reported line 131)May include surrounding context.

md

import { AuthManager } from './auth';
import { MediaUploadResponse } from './types';

const WECHAT_API_BASE = 'https://api.weixin.qq.com/cgi-bin';

export type MediaType = 'image' | 'thumb' | 'voice' | 'video';

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · src/article.ts (reported line 18)May include surrounding context.

ts

import { AuthManager } from './auth';
import { MediaUploadResponse } from './types';

const WECHAT_API_BASE = 'https://api.weixin.qq.com/cgi-bin';

export type MediaType = 'image' | 'thumb' | 'voice' | 'video';

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · src/auth.ts (reported line 12)May include surrounding context.

ts

import { AuthManager } from './auth';
import { MediaUploadResponse } from './types';

const WECHAT_API_BASE = 'https://api.weixin.qq.com/cgi-bin';

export type MediaType = 'image' | 'thumb' | 'voice' | 'video';

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: src/auth.ts:73

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: tests/auth.test.ts:69