Security audit

微信QQ自动发消息

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed WeChat/QQ automation tool, but it can send messages through fragile GUI automation without reliably verifying the recipient or requiring explicit approval in all paths.

Review before installing. Use only in a trusted Windows desktop session, test with non-sensitive contacts first, delete saved screenshots when done, avoid uploading chat captures to outside AI/OCR services, and do not rely on it for sensitive or business-critical messages until recipient verification and stricter confirmation are added.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Warning

Location: qq_send_message.py:54
Finding: QQ messages may be sent to an unverified recipient or application
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: wechat_send_message.py:72
Finding: WeChat messages may be sent through an unverified global screen location
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: qq_capture_and_reply.py:269
Finding: Blank confirmation input is treated as approval to send an OCR-generated reply
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: qq_capture_and_reply.py:112
Finding: Screenshot cleanup can delete unrelated PNG files and does not enforce the stated retention limit
Content: View full analysis
10: old_files = screenshot_files[:-10] for old_file in old_files: old_path = os.path.join(save_dir, old_file) try: os.remove(old_path) except Exception as e: print(f"Unable to delete {old_file}: {e}") timestamp = time.strftime("%Y%m%d_%H%M%S") save_path = os.path.join(save_dir, f"qq_chat_{timestamp}.png") screenshot.save(save_path) ``` The same cleanup pattern appears in `chat_assistant_v2.py`: ```python screenshot_files = [f for f in os.listdir(save_dir) if f.endswith('.png')] screenshot_files.sort(key=lambda x: os.path.getmtime(os.path.join(save_dir, x))) if len(screenshot_files) > 10: old_files = screenshot_files[:-10] for old_file in old_files: try: os.remove(os.path.join(save_dir, old_file)) except: pass timestamp = time.strftime("%Y%m%d_%H%M%S") filename = os.path.join(save_dir, f'chat_capture_{self.platform}_{timestamp}.png') screenshot.save(filename) ``` ### Technical Analysis Cleanup enumerates every file ending in `.png` in a shared OpenClaw screenshot directory. It does not restrict deletion to files created by this Skill, such as `qq_chat_*.png` or `chat_capture_*.png`. Consequently, PNG files created by other tools or manually stored in the same directory can be deleted. Cleanup also runs before the new screenshot is saved. If ten screenshots already exist, the conditio ...[truncated 1286 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: SKILL.md:52
Finding: Third-party packages and OCR artifacts are installed without version or integrity pinning
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (20)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: If QQ support, OCR analysis, smart reply generation, and user-confirmation-before-send are declared but not actually implemented, while clipboard access is used without disclosure, users are being misled about both functionality and risk. In this context, undisclosed clipboard manipulation and automated message sending can affect confidentiality and integrity by exposing copied data or sending unintended content.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: If QQ support, OCR analysis, smart reply generation, and user-confirmation-before-send are declared but not actually implemented, while clipboard access is used without disclosure, users are being misled about both functionality and risk. In this context, undisclosed clipboard manipulation and automated message sending can affect confidentiality and integrity by exposing copied data or sending unintended content.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: If QQ support, OCR analysis, smart reply generation, and user-confirmation-before-send are declared but not actually implemented, while clipboard access is used without disclosure, users are being misled about both functionality and risk. In this context, undisclosed clipboard manipulation and automated message sending can affect confidentiality and integrity by exposing copied data or sending unintended content.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: If QQ support, OCR analysis, smart reply generation, and user-confirmation-before-send are declared but not actually implemented, while clipboard access is used without disclosure, users are being misled about both functionality and risk. In this context, undisclosed clipboard manipulation and automated message sending can affect confidentiality and integrity by exposing copied data or sending unintended content.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown file advertises capabilities to automatically send messages via WeChat/QQ and save screenshots locally, both of which can affect user data and privacy. The description lists the features but provides no warning or disclosure about message automation, screenshot capture/storage, or the need to verify targets before use.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill declares sensitive behaviors such as screenshots and local file storage, but it does not define an explicit tool scope or permissions model. In an automation skill that reads and writes local workspace files, missing capability declarations weakens reviewability and increases the chance of overbroad file access being granted or overlooked.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README explicitly instructs users to send chat screenshots to AI assistants or APIs and to use external OCR services, but it does not warn that those screenshots may contain sensitive personal messages, contact details, account identifiers, or business information. In the context of a tool for automating WeChat/QQ conversations, this omission increases the risk of inadvertent disclosure to third-party AI/OCR providers and could lead to privacy breaches or compliance issues.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill captures chat screenshots and stores them on disk in a predictable local directory without prior warning or explicit consent. Because chat screenshots can contain sensitive personal, business, or authentication information, local persistence increases exposure to other local users, malware, backup sync, or later unintended disclosure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The send_message function automates clipboard paste and message submission to WeChat/QQ with no explicit confirmation or preview step. In a GUI automation context, this can cause accidental or misdirected message delivery, and if called by other code with untrusted input it could transmit sensitive or harmful content to the wrong recipient.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest describes a tool that supports contact search, message sending, screenshot OCR analysis, and intelligent reply suggestions requiring user confirmation before sending. In this file, the main workflow searches contacts and performs screenshot capture plus OCR, but it never generates reply suggestions or performs a confirmation-gated send step; the output instead tells the user to send the screenshot to an external AI assistant for analysis.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The OCR call fixes recognition to chi_sim+eng, which imposes a language/locale constraint in behavior. The file also presents itself generally as an OCR helper, but does not offer opt-in or configuration for other languages, which can violate language-choice policy expectations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The reader configuration ['ch_sim', 'en'] forces a specific language set for all uses of the helper. Because the file does not provide a user-selectable language option or clearly justify a region-specific constraint, this is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger pattern 给.*发消息 is overly broad and can match a wide range of ordinary user requests, causing this automation skill to activate in situations the user may not intend. In the context of a Windows GUI automation tool that can search contacts, manipulate the clipboard, take screenshots, and send messages, accidental invocation increases the risk of unintended message delivery and exposure of on-screen sensitive information.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script captures chat screenshots and persists them under ~/.openclaw/workspace/screenshots, which can retain sensitive conversation content on disk without explicit notice, consent, or retention controls. Local-only storage reduces exposure compared with exfiltration, but on shared systems, compromised accounts, backups, or forensic recovery, these files may disclose private messages and contacts.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest description says the skill supports intelligent reply suggestions that require user confirmation before sending. In this file, once the user confirms in the console, the code directly focuses the QQ input box, pastes text, and presses Enter to send the message, implementing actual message transmission rather than only producing a suggestion.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script temporarily replaces the user's clipboard with arbitrary message content and restores it afterward without any warning, consent, or safeguards. On Windows, the clipboard is globally accessible and can contain sensitive data such as passwords, tokens, wallet addresses, or private text; overwriting it can leak or destroy user data, and restoration may fail if the process crashes or the clipboard changes concurrently.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The manifest describes a Windows tool for both 微信 and QQ auto-messaging, with screenshot OCR analysis and smart reply suggestions requiring user confirmation. This file implements only WeChat window discovery and message sending via GUI automation; there is no QQ handling, no OCR logic, no screenshot analysis workflow, and no reply-suggestion step.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The natural-language instructions and headings are presented entirely in Chinese, which can constitute a language/locale policy issue when no user opt-in or locale limitation is stated. There is no indication that the skill is intentionally restricted to a Chinese-speaking or region-specific audience.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The natural-language description and runtime behavior are tailored specifically to Chinese platforms and initialize OCR with Chinese Simplified and English only. There is no user-facing option to select language or locale, which can violate language/locale policy when a skill imposes a specific language context by default.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: After OCR, the variable result holds the recognized text returned by ocr_chat, not the screenshot filename. The message 完成！截图已保存: {result} therefore contradicts the actual value being displayed and misrepresents what the function produced.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.