ClawHub
Back to skill

Security audit

微信 ClawBot 插件安装

Security checks for vulnerabilities and agentic risk

Overview

This setup skill is for a real WeChat/OpenClaw workflow, but it exposes login QR contents to a third-party QR service and persistently rewrites an installed dependency.

Review this carefully before installing. Prefer a version-pinned installer and a local QR rendering method that does not send WeChat login QR contents to a third-party service. If used anyway, run it only in a controlled OpenClaw environment, understand that it rewrites the installed qrcode-terminal dependency, and be prepared to restore the backup or reinstall the plugin.

A.I.G

Vulnerability Patterns
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

other

Error
Location
scripts/patch-qrcode-terminal.sh:25
Finding

WeChat Login QR Payload Disclosed to a Third-Party Service

Content
View full analysis
Remediation
View remediation

T07 · Tool Hijacking and Spoofing

Error
Location
scripts/patch-qrcode-terminal.sh:20
Finding

Installed QR Dependency Is Rewritten In Place

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:21
Finding

Mutable Latest Package Release Is Downloaded and Executed

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger description includes very broad phrases such as general references to WeChat/微信, which can cause the skill to activate during ordinary conversation rather than an explicit installation request. Over-broad activation increases the chance that users are steered into running setup, patching files, or initiating external connections without clear intent.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The skill installs and executes a package via npx ...@latest, which fetches whatever version is current at runtime rather than a reviewed, pinned release. That creates a supply-chain execution risk: if the package is compromised or a breaking/malicious update is published, users will run attacker-controlled code immediately during setup.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

These instructions modify code to send QR payload data to a third-party service and require opening the resulting URL in a browser, but they do not clearly warn the user that login material will be transmitted off-host. In this context, the QR content may represent sensitive authentication or session bootstrap data, so silent external transmission materially increases credential/session exposure risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
98% confidence
Finding

The patch rewrites QR rendering so the raw QR payload is URL-encoded and sent to api.qrserver.com, a third-party external service. If that payload contains authentication material for WeChat/OpenClaw login, the service and any intermediary logs gain access to sensitive token/bootstrap data, enabling account linkage abuse or session compromise.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md
sed -i '/var qrcode = new QRCode(-1, this.error);/c\
        // Patched: output image URL instead of ASCII\
        var encoded = encodeURIComponent(input);\
        var imageUrl = "https://api.qrserver.com/v1/create-qr-code/?size=400x400&data=" + encoded;\
        var output = "\\n📷 扫码链接（复制到浏览器打开或微信扫一扫）:\\n" + imageUrl + "\\n";\
        if (cb) cb(output); else console.log(output);\
        return;\n' "$QR_MAIN"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

This shell script performs direct file write operations by copying the target file to a backup and then editing the original file in place with sed. While the script has brief comments and a success message, it does not clearly warn the user beforehand that it will alter installed plugin code on disk or prompt for confirmation before making the change.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
97% confidence
Finding

The patch changes QR rendering so the QR payload is embedded into a third-party URL at api.qrserver.com, causing the WeChat login/connection token to be transmitted to an external service. In this context, the QR contents are likely authentication material or session bootstrap data, so exposing them to an unrelated remote service could allow account/session hijacking or unauthorized linkage of the bot if the URL is logged, intercepted, or retained by that service.

Content

Scanner excerpt · scripts/patch-qrcode-terminal.sh (reported line 30)May include surrounding context.

sh
sed -i '/var qrcode = new QRCode(-1, this.error);/c\
        // Patched: output image URL instead of ASCII\
        var encoded = encodeURIComponent(input);\
        var imageUrl = "https://api.qrserver.com/v1/create-qr-code/?size=400x400&data=" + encoded;\
        var output = "\\n📷 扫码链接（复制到浏览器打开或微信扫一扫）:\\n" + imageUrl + "\\n";\
        if (cb) cb(output); else console.log(output);\
        return;\n' "$QR_MAIN"

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

The inserted string literal presents the QR-code instructions only in Chinese, which imposes a specific language on users regardless of their locale. There is no indication in the script that this is a region-specific tool or that users can opt into or select the output language.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.