微信公众号内容自动生成与发布到草稿箱

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:18 AM UTC
• Version: 1.0.1

Overview

This WeChat publishing skill is not clearly malicious, but it needs review because it rewrites articles, adds fixed branding, recommends persistent scheduled runs, and has broken publication safety gates.

Review carefully before installing. Do not connect real WeChat or API credentials, add the cron job, or run it on existing articles until publication is gated by successful checks, dry-run/confirmation is added, hard-coded attribution is made configurable, and article rewrites are previewed or backed up.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Warning

• Location: scripts/auto_images.py:116

Finding

Hard-Coded Attribution and Publisher Branding Injected into User Articles

Content

View full analysis

/正文.md` location. 2. The user invokes `scripts/auto_images.py` for the documented image-processing function. 3. `process_article()` downloads images and calls `insert_images_to_article()`. 4. If the fixed AI-generation text is not already present, the function appends the hard-coded author and publisher branding. 5. The rewritten article can subsequently enter the publication workflow with attribution that the user did not select at runtime. ### Impact Assessment The behavior does not grant operating-system privileges or execute arbitrary cod ...[truncated 438 chars]

Remediation

View remediation

T06 · System Persistence

Warning

• Location: references/config.md:34

Finding

Optional Automation Instructions Establish a Persistent Recurring Cron Task

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/run_pipeline.py:153

Finding

Failed Safety Checks Do Not Prevent the Publication Stage

Content

View full analysis

bool: """直接发布到公众号草稿箱""" print("📋 正在发布到公众号草稿箱...") # 这里调用公众号发布API（跳过腾讯文档中转） print("✅ 公众号草稿箱发布成功") return True ``` ### Technical Analysis The pipeline calculates the precheck result but does not use it as an authorization condition for publication. When checks fail, the code only prints that the article was added to a review queue. Execution then proceeds to the publication block whenever `"publish"` is present in `steps`. This is a fail-open control-flow design. A safety check is effective only if its successful result is a mandatory prerequisite for the protected operation. Here, formatting, sensitive-word, and duplication failures do not terminate the pipeline or remove the publication step. The checks themselves are also incomplete: - The sensitive-word list contains placeholder values. - The published-title database is an empty placeholder. - `add_to_review_queue()` only prints messages and does not persist a review item. - `pub ...[truncated 1878 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

A second, more detailed mismatch indicates the pipeline may not actually generate images, perform real checks, or publish successfully, and may reference undefined variables during publish. In this context, false claims of end-to-end automation are dangerous because operators may rely on the skill for unattended content handling, while the actual behavior silently falls back to partial edits, mock checks, or broken publish logic.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

A second, more detailed mismatch indicates the pipeline may not actually generate images, perform real checks, or publish successfully, and may reference undefined variables during publish. In this context, false claims of end-to-end automation are dangerous because operators may rely on the skill for unattended content handling, while the actual behavior silently falls back to partial edits, mock checks, or broken publish logic.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 250)May include surrounding context.

│ │ ├── 正文.md ← 文章内容（含图片引用） │ │ └── images/ ← 配图目录（自动下载） │ └── ... ├── .env ← API配置 └── references/ └── config.md ← 配置说明

text

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill describes capabilities that imply network access, file reads/writes, and environment-variable use, but it does not declare any explicit tool scope or allowed-tools boundaries. In an automation skill that downloads content, modifies local article files, and interacts with publishing APIs, missing scope declarations weakens least-privilege controls and makes unintended or excessive operations harder to constrain or review.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill promotes direct publication to WeChat drafts and scheduled unattended execution without a prominent warning about external side effects. In a publishing workflow, this increases the chance of accidental dissemination of unreviewed, noncompliant, or manipulated content because users may invoke automation without understanding that it can perform outward-facing actions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/config.md (reported line 37)May include surrounding context.

bash

# 编辑 crontab
crontab -e

# 添加
0 8 * * * cd /root/.openclaw/workspace/skills/wechat-content-pipeline && python3 scripts/run_pipeline.py --topic 深度学习 --count 8

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code file contains user-facing natural-language descriptions entirely in Chinese, presenting the tool as a Chinese-language script without any indication of optional locale selection. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The module docstring states this is the main workflow for full content generation→precheck→publish automation, and several function docstrings imply real API-backed checks and publishing. In practice, the functions return hardcoded/local values and only print status messages, which materially contradicts the documented intent of an operational automation pipeline.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/run_pipeline.py (reported line 17)May include surrounding context.

python

# ========== 用户自有工具 ==========
# MiniMax API (已配置)
MINIMAX_API_KEY = os.environ.get("MINIMAX_API_KEY", "")
API_URL = "https://api.minimaxi.com/v1/image_generation"

# ========== 配置 ==========
TOPIC_TEMPLATES = {

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest claims a full pipeline including image matching with 5+ images per article and direct draft-box publishing via integrated user tools. In this file, content generation is a local stub, the MiniMax image API is never called, and publishing only prints success messages without performing actual publication or image handling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Automating publication to an external WeChat account without an explicit user confirmation or warning increases the risk of unintended content modification or publication. In an agent/skill context, actions affecting third-party platforms should require clear disclosure and a confirmation gate because mistaken or unauthorized publishing can damage account integrity and reputation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The documentation says the skill will automatically download images and insert references into article directories, but it does not clearly warn users that local files will be created and existing article content will be modified. While this is not inherently malicious, silent filesystem changes are a safety issue in automation tools because they can overwrite work, introduce unreviewed assets, or make provenance tracking harder.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

Natural-language strings in the file, including the top-level description and user-facing messages, assume Chinese as the only interaction language. The file does not offer user opt-in for language/locale or explain that the skill is intentionally restricted to a Chinese-language regional use case.

Content

No source excerpt is available for this finding.