Security audit

Wechat Formatter

Security checks for vulnerabilities and agentic risk

Overview

This is a local Markdown-to-WeChat formatter with one cautionary example that can copy a chosen local memory file to the clipboard.

Install only if you want a Chinese-language command-line formatter for WeChat Official Account publishing. Be careful with the documented pbcopy example: formatting files under ~/.openclaw/workspace/memory may place private agent-memory content on the system clipboard, where clipboard history or sync tools could expose it.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

other

Warning

Location: SKILL.md:64
Finding: Sensitive Agent Memory Copied to the System Clipboard
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · install.sh (reported line 7)May include surrounding context.
sh
echo "📦 正在安装 wechat-formatter..." # 复制文件 mkdir -p ~/.openclaw/skills/wechat-formatter cp wechat_formatter.py ~/.openclaw/skills/wechat-formatter/ cp SKILL.md ~/.openclaw/skills/wechat-formatter/

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The description uses broad promotional language and generic formatting claims without clearly constraining when the skill should activate. In an agent setting, this can cause overbroad matching on ordinary writing or formatting requests, increasing the chance the skill is invoked unexpectedly and processes user content outside its intended scope.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The description is entirely in Chinese and does not state that the skill is intended only for Chinese-speaking users or Chinese-language WeChat publishing workflows. This can lead to incorrect activation or user confusion in multilingual environments, where the orchestrator may select the skill despite the user not requesting a Chinese-localized formatting tool.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This code includes natural-language descriptions that force a specific language/locale experience for users. The policy allows locale constraints only when they are explicitly justified or when the user is given a language choice, neither of which is present here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This shell script contains user-facing natural-language strings entirely in Chinese, including installation status and usage guidance. Because the file does not offer a language choice or indicate that the skill is intentionally region-specific, it may violate language/locale policy requirements.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The markdown content uses Chinese throughout, and there is no natural-language indication that the language choice is optional or tied to a documented region-specific requirement. Under the stated policy, forcing a specific language without user opt-in can be a locale-policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This markdown file presents all user-facing content in a single language and does not indicate that the language was selected by the user or that the skill is intended only for a Chinese-language context. That can violate language/locale policy when users are not given an explicit opt-in or alternative.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The command-line help text is presented only in Chinese, which imposes a language choice on all users. There is no indication that the tool is intentionally restricted to a Chinese-only audience or that alternate locales are supported.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.