ClawHub
Back to skill

Security audit

WeChat Article Fetcher

Security checks for vulnerabilities and agentic risk

Overview

This skill gives straightforward instructions for fetching and summarizing WeChat articles, with disclosed optional archiving and no executable code or hidden behavior.

Installers should understand that this skill may fetch article content and, when asked, save it to Feishu or local markdown. Confirm before archiving full text, especially for private, internal, or copyrighted articles.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
81% confidence
Finding
The activation criteria are broad enough to trigger fetching and archiving behavior whenever a user shares a WeChat article link, without clearly limiting use to explicit extraction or summarization requests. This can lead to unnecessary collection and retention of third-party content, increasing privacy, copyright, and data-handling risk even if the author likely intended convenience rather than abuse.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill instructs the agent to save fetched article content to Feishu or local markdown without a clear warning, consent check, or data-minimization rule. If articles contain sensitive, internal, or copyrighted material, automatic persistence can create unauthorized retention and secondary disclosure risks beyond the original user request.

Static analysis

No suspicious patterns detected.