ClawHub
Back to skill

Security audit

wechat-publisher

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent WeChat publishing/admin tool, but it can publish and delete live account content and comments without confirmation safeguards.

Install only if you intend to let the agent operate a live WeChat official account. Use restricted WeChat credentials where possible, review every publish/delete/moderation command before running it, and avoid letting automated workflows invoke destructive commands without an external approval step.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (15)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill requires WeChat credentials and is designed to send content, metadata, and account-linked operations to external WeChat APIs, but the setup section does not clearly disclose this data flow. In a tool that handles publishing and statistics, lack of explicit external-transmission notice can lead to uninformed credential use and accidental sharing of content or account data with a third-party service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The documentation exposes multiple state-changing and destructive operations such as publish, delete, comment deletion, and reply management, but it does not prominently warn that these commands act on a live WeChat account and may permanently modify or remove remote content. In an agent context, unclear disclosure increases the chance of accidental destructive actions by users or higher-level automation that interprets the skill as informational rather than operational.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The top-level docstring describes the script as a '微信公众号文章发布工具' and says it covers publishing-related APIs, which implies a publishing-focused scope. However, the code also includes article statistics retrieval and comment management operations, expanding into analytics and moderation rather than just publishing.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/publish_wechat.py (reported line 25)May include surrounding context.

python
# ── Constants ─────────────────────────────────────────────
WECHAT_API_BASE = "https://api.weixin.qq.com/cgi-bin"
DATACUBE_BASE = "https://api.weixin.qq.com/datacube"
RATE_LIMIT_DAY = 2000
RATE_LIMIT_WINDOW = 86400

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/publish_wechat.py (reported line 26)May include surrounding context.

python
# ── Constants ─────────────────────────────────────────────
WECHAT_API_BASE = "https://api.weixin.qq.com/cgi-bin"
DATACUBE_BASE = "https://api.weixin.qq.com/datacube"
RATE_LIMIT_DAY = 2000
RATE_LIMIT_WINDOW = 86400

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The draft delete command performs an irreversible remote deletion immediately from a single CLI invocation with no confirmation, dry-run, or force gate. In an agent or automation context, argument mix-ups or prompt-induced misuse could destroy content unintentionally and with little operator awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

Published article deletion is a destructive action against live content, yet the command executes without any user-facing warning or confirmation barrier. In a skill/agent setting, this increases the risk of accidental or coerced deletion of production content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

Material deletion removes stored media immediately with no confirmation step. Because this CLI is designed for automation and remote API control, accidental invocation can disrupt future publishing workflows or break references to required assets.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

Comment deletion removes user-generated content without confirmation or disclosure, which is a destructive moderation action. In an agent-operated environment, this can lead to unintended censorship or loss of auditability if commands are triggered incorrectly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

Reply deletion is another irreversible moderation operation performed with no warning or consent checkpoint. This makes accidental removal easy, especially when operated by an autonomous agent or script processing untrusted instructions.

Content

No source excerpt is available for this finding.

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · LICENSE.txt (reported line 12)May include surrounding context.

text
permit persons to whom the Software is furnished to do so.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE
FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

SQP-3 applies to natural-language policy violations in all file types, including markdown. The file presents all user-facing instructions and descriptions only in Chinese, which can amount to forcing a specific language without user opt-in when no alternative language option or justification is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The natural-language strings at the top of the file present the tool entirely in Chinese and do not indicate any language choice or opt-in. Under the policy, forcing a specific language without offering alternatives can be a locale/language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

User-facing errors, help text, and status output throughout the CLI are hardcoded in Chinese, and the file does not expose any language selection mechanism. This can violate language/locale policy where users must be given a choice unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The help text presents the tool primarily as a publishing utility, but the implemented commands include destructive management actions such as deleting drafts, materials, published articles, comments, and replies. Those write/delete behaviors are broader than a narrowly understood 'publish' function.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.