ClawHub
Back to skill

Security audit

热点追踪，写作画像自定义，创作发布一体化自媒体内容创作助手

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Chinese social-media writing assistant, but it can upload content to Tencent Docs and WeChat and documents an unpinned third-party MCP install without strong user-confirmation or scoping safeguards.

Install only if you intend to use Chinese-platform writing workflows and are comfortable with content being sent to Tencent Docs or WeChat when publishing features run. Before using publish or backup steps, verify the target account, review the exact article and cover image, and require your agent to ask before remote writes. Avoid the optional third-party MCP install unless you review and pin the repository and dependencies, and store AppSecret/MCP tokens securely rather than relying on hard-coded paths or claimed existing configuration.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:272
Finding

Unpinned Third-Party MCP Repository and Dependency Installation

Content
View full analysis
Remediation
View remediation
``` 2. Publish the expected commit ID and release checksum in the Skill documentation so users can verify downloaded content before installation. 3. Replace floating Python requirements with exact versions and cryptographic hashes. Install them using hash verification: ```bash python -m pip install --require-hashes -r requirements.lock ``` 4. Review and lock all transitive dependencies rather than pinning only direct dependencies. 5. Install the MCP server in a dedicated virtual environment or isolated container under a low-privilege account. 6. Restrict the MCP process to the minimum required filesystem and network permissions. It should not receive unrelated OpenClaw credentials or workspace access. 7. Recommend reviewing repository changes, dependency provenance, and package installation hooks before updating to a newer commit or release. 8. Avoid claiming that the integration is configured or trusted solely because a token exists; document how credentials should be scoped, stored, and rotated. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (13)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README advertises integrated publishing and Tencent Docs backup behavior but does not clearly warn users that generated or supplied content may be sent to third-party external services. This creates a meaningful privacy and data-handling risk because users may provide sensitive drafts, account-linked content, or unpublished material without understanding that it could leave the local environment.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 46)May include surrounding context.

2. 复制写作画像库（可选）

bash
mkdir -p ~/.openclaw/workspace/文风参考库/写作画像库
cp -r 文风参考库/* ~/.openclaw/workspace/文风参考库/

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 46)May include surrounding context.

2. 复制写作画像库(可选)

bash
mkdir -p ~/.openclaw/workspace/文风参考库/写作画像库
cp -r 文风参考库/* ~/.openclaw/workspace/文风参考库/

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The invocation examples are very broad everyday phrases like writing an article or tracking a topic, without clear boundaries for when the skill should activate or what it is allowed to do. In a skill that can search for trends and publish or back up content to external services, ambiguous triggers increase the chance of accidental activation and unintended data transmission or publishing actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill performs browser-based scraping and optional reading of public-account articles via an MCP tool, but it does not disclose that prompts, URLs, or retrieved content may be sent to third-party services or remote endpoints. This creates a privacy and data-handling risk, especially if user-supplied topics, links, or account content are sensitive.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs automatic synchronization to Tencent Docs and creation of WeChat public-account drafts, which modifies external systems and can transmit user-generated content off-platform. Without an explicit confirmation step or warning that these actions will create remote documents/drafts, users may trigger unintended external side effects and content disclosure.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The skill is configured to obtain an access token from the WeChat API as part of an automated publishing workflow, which is an external network transmission tied to account operations. In context, this is expected functionality, but it still becomes security-relevant because the skill lacks explicit consent gates and clear disclosure before contacting external publishing endpoints.

Content

Scanner excerpt · SKILL.md (reported line 251)May include surrounding context.

md
4. 创建草稿

**公众号API：**
- access_token获取：`https://api.weixin.qq.com/cgi-bin/token`
- 上传封面：`https://api.weixin.qq.com/cgi-bin/material/add_material`
- 创建草稿：`https://api.weixin.qq.com/cgi-bin/draft/add`

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

Uploading a cover image to the WeChat material endpoint transmits generated content to an external service and may persist assets under the user's public-account infrastructure. While consistent with the publishing feature, it is dangerous without clear notice because users may not realize media is being uploaded and retained remotely.

Content

Scanner excerpt · SKILL.md (reported line 252)May include surrounding context.

md
**公众号API：**
- access_token获取：`https://api.weixin.qq.com/cgi-bin/token`
- 上传封面：`https://api.weixin.qq.com/cgi-bin/material/add_material`
- 创建草稿：`https://api.weixin.qq.com/cgi-bin/draft/add`

---

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

Creating a draft via the WeChat API sends the article body to an external platform and creates a persistent draft artifact associated with the user's account. The risk is elevated by the skill's end-to-end automation language, which may cause unintended publication workflow side effects if users are not clearly informed and asked to confirm.

Content

Scanner excerpt · SKILL.md (reported line 253)May include surrounding context.

md
**公众号API：**
- access_token获取：`https://api.weixin.qq.com/cgi-bin/token`
- 上传封面：`https://api.weixin.qq.com/cgi-bin/material/add_material`
- 创建草稿：`https://api.weixin.qq.com/cgi-bin/draft/add`

---

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The file-level description and platform fields describe a Xiaohongshu '大字报' content reference for the Norrona brand, but this section is explicitly documented as '公众号发布配置 - 科技资讯风格' and defines a WeChat article publishing workflow including cover upload and draft-box API creation. This is an active contradiction in the embedded documentation/configuration rather than a mere omission, because the comments and field names state a different platform and publishing target from the rest of the file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
71% confidence
Finding

Natural-language policy review applies to all file types. The file presents the skill entirely in Chinese and all invocation examples assume Chinese usage, but it does not indicate that this is an optional language preference or that the skill is intentionally limited to a Chinese-speaking or region-specific context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The skill mandates use of a Chinese colloquial lexicon such as "说实话" and "讲真" as part of quality checks, which effectively forces a specific language/style. There is no indication that users can opt into another language or locale, so this conflicts with the requirement to avoid fixed language constraints without user choice.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The configuration is documented as '科技资讯风格' with repeated references to '科技资讯风' cover design and category tags, while the rest of the file describes Norrona outdoor-focused Xiaohongshu poster content for outdoor consumers. These documentation cues point to a different editorial intent and audience framing than the file claims elsewhere.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.