issue-request-manager

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 2:26 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent issue-tracking helper with optional WeChat notifications, but users should handle notification content and WeChat secrets carefully.

Install only if you are comfortable with issue metadata being sent to WeChat/WeCom when notification functions are enabled or called. Keep WeChat application secrets out of tracked config files, prefer environment variables or a secret manager, restrict recipients, and avoid notifying on issues containing secrets, incidents, regulated data, or customer-sensitive details.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: NOTIFICATION_GUIDE.md:20

Finding

Plaintext WeCom application secret storage is recommended

Content

View full analysis

Vulnerability Details

File Location: NOTIFICATION_GUIDE.md:20-29
Vulnerability Type: Plaintext credential storage
Risk Level: Medium

json

{
  "default_settings": {
    "wechat_notification": {
      "enabled": true,
      "corp_id": "your_corp_id_here",
      "secret": "your_secret_here",
      "agent_id": 1000001
    }
  }
}

Related instructions also appear in README.md:71-80, while the corresponding plaintext field is defined in config.json:19-25.

Technical Analysis

The primary configuration instructions direct users to put a live WeCom application secret directly in config.json. Although the distributed configuration contains an empty value and the notification guide later recommends using environment variables, the documented setup process still encourages persistent plaintext credential storage inside the project directory.

A project-level configuration file is commonly copied into backups, included in deployment artifacts, shared with other users, or accidentally committed to source control. The code then loads the secret directly from this file in the notification examples. No secret manager, environment-variable lookup, permission validation, or protection against source-control inclusion is implemented.

This finding does not indicate that the shipped project contains a real credential. The exposure arises when an operator follows the documented configuration process.

Attack Path

1. An operator enables WeCom notifications.
2. The operator follows the guide and writes the real CorpID and application secret into config.json.
3. The configuration file is committed, archived, copied, or left readable by another local account.
4. An attacker obtains the plaintext application secret.
5. The attacker submits the CorpID and secret to the official WeCom token endpoint.
6. Subject to the permissions assigned to that WeCom application, the attacker obtains an access token and can invoke authorized WeCom APIs.

Im

...[truncated 432 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the secret value from tracked project configuration.
2. Read the secret from an environment variable or an operating-system/cloud secret manager.
3. Keep only non-sensitive values, such as agent_id, in the regular configuration file.
4. Provide a sanitized config.example.json rather than instructing users to modify a tracked configuration file with live credentials.
5. Add local secret-bearing configuration files to .gitignore.
6. Restrict local secret-file permissions to the service account if file-based injection is unavoidable.
7. Add startup validation that rejects placeholder, missing, or insecurely sourced credentials.
8. Rotate any secret that has previously been committed or shared; removing it from the latest revision does not remove it from repository history.
9. Update all examples to use a pattern such as:

python

import os

secret = os.environ["WECOM_APP_SECRET"]

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unsafe and non-reproducible dependency declarations

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1-10
Vulnerability Type: Unbounded and unnecessary third-party dependencies
Risk Level: Medium

text

# Issue Request Manager Skill Requirements

# 基础依赖
python>=3.7

# 数据处理
json5>=0.9.0

# 网络请求（用于微信通知）
requests>=2.25.1

Technical Analysis

The dependency file declares packages using unrestricted lower bounds and does not provide hashes or a lock file. This allows future versions that have not been reviewed with the Skill to be installed.

python>=3.7 is also incorrectly specified as a pip package dependency. Python interpreter compatibility should be declared in package metadata, not as a package named python. Installing an unintended package with a generic name unnecessarily expands the supply-chain attack surface.

The audited code does not import or use json5, making that dependency unnecessary. Every unnecessary dependency introduces additional package metadata, build logic, and transitive dependency exposure.

No currently declared package was proven malicious during this static audit. The vulnerability is the unsafe and non-reproducible installation policy.

Attack Path

1. A user follows the documented installation command: pip install -r requirements.txt.
2. Pip resolves the generic python distribution and the latest versions satisfying the open-ended constraints.
3. A future compromised, malicious, or incompatible eligible package version is selected, or an unintended package is installed because of the invalid interpreter declaration.
4. Package build or installation logic executes in the context of the user running pip.
5. Malicious package code could act with that user's filesystem, network, and process privileges.

This attack path depends on an upstream package compromise, malicious release, or unintended package resolution; none was observed in the audited project itself.

Impact Assessment

A malicious dependency could execute with the privileges o ...[truncated 383 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove python>=3.7 from requirements.txt.
2. Declare interpreter compatibility through package metadata, such as requires-python.
3. Remove json5 unless the project actually uses it.
4. Pin dependencies to reviewed versions or tightly controlled compatible ranges.
5. Generate a reproducible lock file for deployment.
6. Use hash verification, such as pip's --require-hashes, for production installation.
7. Review transitive dependencies and automate vulnerability scanning.
8. Avoid running pip as root or an administrator.
9. Install dependencies inside an isolated virtual environment or container.
10. Periodically update pins through a controlled review and test process.

A minimal dependency declaration should contain only the reviewed requests version required by the notifier.

T09 · Insecure Skill Coding Practices

Note

• Location: wechat_notifier.py:44

Finding

WeCom network requests have no timeout or HTTP status validation

Content

View full analysis

Vulnerability Details

File Location: wechat_notifier.py:44-64 and wechat_notifier.py:108-127
Vulnerability Type: Unbounded network operations and insufficient response validation
Risk Level: Low

python

url = f"https://qyapi.weixin.qq.com/cgi-bin/gettoken"
params = {
    "corpid": self.corp_id,
    "corpsecret": self.secret
}

response = requests.get(url, params=params)
result = response.json()

if result.get("errcode") == 0:
    self.access_token = result.get("access_token")
    # token有效期为7200秒，提前10分钟刷新
    self.token_expires_at = datetime.now().timestamp() + 7100
    logger.info("成功获取access_token")
    return self.access_token
else:
    logger.error(f"获取access_token失败: {result}")
    return ""

python

url = f"https://qyapi.weixin.qq.com/cgi-bin/message/send?access_token={self.access_token}"
headers = {"Content-Type": "application/json; charset=utf-8"}

response = requests.post(url, 
                      data=json.dumps(msg_content, ensure_ascii=False).encode('utf-8'),
                      headers=headers)

result = response.json()

if result.get("errcode") == 0:
    logger.info(f"微信通知发送成功，接收者: {users}")
    return True
else:
    logger.error(f"微信通知发送失败: {result}")
    return False

Technical Analysis

Neither the token request nor the message request specifies connect or read timeouts. Requests may therefore wait indefinitely when DNS resolution, connection establishment, TLS negotiation, or response delivery stalls.

The implementation also parses JSON without first checking the HTTP status or validating the response content type. HTTP error pages, proxy responses, or malformed content are handled only by the broad exception block, reducing observability and making transient and permanent failures indistinguishable.

The access token is included in the message endpoint's query string. This is consistent with the relevant WeCom API interface, but token-bearing URLs require log and telemetry redaction because reverse pro ...[truncated 1601 chars]

Remediation

View remediation

Remediation Suggestions

1. Add explicit connect and read timeouts to every request:

python

response = requests.get(url, params=params, timeout=(5, 15))
response.raise_for_status()

python

response = requests.post(
    url,
    data=json.dumps(msg_content, ensure_ascii=False).encode("utf-8"),
    headers=headers,
    timeout=(5, 15),
)
response.raise_for_status()

2. Catch requests.Timeout, requests.ConnectionError, and requests.HTTPError separately.
3. Validate the response content type before parsing JSON.
4. Implement bounded retries with exponential backoff only for safe transient failures.
5. Avoid logging request URLs containing tokens.
6. Configure proxies, tracing systems, and error-reporting tools to redact the access_token query parameter.
7. Use a shared requests.Session with centrally enforced timeout, retry, TLS, and proxy policies.
8. Apply notification rate limits and worker isolation so a failed notification service cannot block core issue-management operations.
9. Report notification failure accurately without marking a notification as sent when the operation returned False.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (39)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

A skill that actually sends data to an external enterprise messaging API while presenting itself as a generic issue-lifecycle manager creates a hidden exfiltration and unintended-disclosure risk. The mismatch is more dangerous in this context because issue data often contains internal project details, identifiers, and operational status that should not be transmitted to an undeclared third-party endpoint.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

A skill that actually sends data to an external enterprise messaging API while presenting itself as a generic issue-lifecycle manager creates a hidden exfiltration and unintended-disclosure risk. The mismatch is more dangerous in this context because issue data often contains internal project details, identifiers, and operational status that should not be transmitted to an undeclared third-party endpoint.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

A skill that actually sends data to an external enterprise messaging API while presenting itself as a generic issue-lifecycle manager creates a hidden exfiltration and unintended-disclosure risk. The mismatch is more dangerous in this context because issue data often contains internal project details, identifiers, and operational status that should not be transmitted to an undeclared third-party endpoint.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

A skill that actually sends data to an external enterprise messaging API while presenting itself as a generic issue-lifecycle manager creates a hidden exfiltration and unintended-disclosure risk. The mismatch is more dangerous in this context because issue data often contains internal project details, identifiers, and operational status that should not be transmitted to an undeclared third-party endpoint.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

A skill that actually sends data to an external enterprise messaging API while presenting itself as a generic issue-lifecycle manager creates a hidden exfiltration and unintended-disclosure risk. The mismatch is more dangerous in this context because issue data often contains internal project details, identifiers, and operational status that should not be transmitted to an undeclared third-party endpoint.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

A skill that actually sends data to an external enterprise messaging API while presenting itself as a generic issue-lifecycle manager creates a hidden exfiltration and unintended-disclosure risk. The mismatch is more dangerous in this context because issue data often contains internal project details, identifiers, and operational status that should not be transmitted to an undeclared third-party endpoint.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

A skill that actually sends data to an external enterprise messaging API while presenting itself as a generic issue-lifecycle manager creates a hidden exfiltration and unintended-disclosure risk. The mismatch is more dangerous in this context because issue data often contains internal project details, identifiers, and operational status that should not be transmitted to an undeclared third-party endpoint.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

A skill that actually sends data to an external enterprise messaging API while presenting itself as a generic issue-lifecycle manager creates a hidden exfiltration and unintended-disclosure risk. The mismatch is more dangerous in this context because issue data often contains internal project details, identifiers, and operational status that should not be transmitted to an undeclared third-party endpoint.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

A skill that actually sends data to an external enterprise messaging API while presenting itself as a generic issue-lifecycle manager creates a hidden exfiltration and unintended-disclosure risk. The mismatch is more dangerous in this context because issue data often contains internal project details, identifiers, and operational status that should not be transmitted to an undeclared third-party endpoint.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

A skill that actually sends data to an external enterprise messaging API while presenting itself as a generic issue-lifecycle manager creates a hidden exfiltration and unintended-disclosure risk. The mismatch is more dangerous in this context because issue data often contains internal project details, identifiers, and operational status that should not be transmitted to an undeclared third-party endpoint.

Content

No source excerpt is available for this finding.

YARA rule 'offensive_tool_references': References to well-known offensive security tools [hacktools]

High

• Category: YARA Match
• Confidence: 70% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · config.json (reported line 9)May include surrounding context.

json

{
  "name": "Issue Request Manager",
  "version": "1.0.0",
  "description": "管理Issue Request的完整生命周期",
  "author": "OpenClaw Assistant",
  "modules": {
    "creator": "ir_creator.py",
    "tracker": "ir_tracker.py",
    "responder": "ir_responder.py",
    "database": "ir_database.py",
    "notifier": "wechat_notifier.py"
  },
  "default_settings": {
    "default_priority": "medium",
    "default_status": "open",
    "notification_enabled": true,
    "auto_save": true,
    "max_comments": 100,
    "wechat_notification": {
      "enabled": false,
      "corp_id": "",
      "secret": "",
      "agent_id": 0
    }
  },
  "supported_platforms": [
    "local",
    "github",
    "gitlab",
    "jira"
  ],
  "api_endpoints": {
    "create": "/api/issues/create",
    "track": "/api/issues/{id}/track",
    "reply": "/api/issues/{id}/rep

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The guide instructs users to send issue titles, descriptions, status changes, assignees, and recipient identifiers through WeChat, which is an external third-party messaging service, but it does not explicitly warn about data disclosure, sensitivity classification, or compliance implications. In an issue-management context, issue content may contain internal project details, personal data, or security-sensitive incident information, so silent external transmission creates a real privacy and confidentiality risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README instructs users to enable WeChat notifications with corporate credentials and send issue updates externally, but it does not warn that issue titles, descriptions, assignees, or status data may be transmitted to a third-party messaging platform. In an issue-management skill, this can expose sensitive internal project, security, or customer information through misconfiguration or overbroad notification use.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill declares operational capabilities that imply file access and network interaction, but it does not define any explicit tool scope or permission boundaries. In an agent environment, this creates an over-privileged and under-specified execution surface where the runtime may allow unintended reads, writes, or outbound requests without user visibility.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Natural-language strings, comments, and output in this file consistently enforce Chinese as the interaction language. Under the policy, forcing a specific language without user opt-in or a documented locale-specific justification is a language/locale policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The code sends issue-related notifications to WeChat recipients based on local configuration without any explicit consent prompt, warning, or data-classification check before transmitting potentially sensitive issue metadata to an external messaging platform. In an issue-management context, tickets may contain internal project details, security information, or personal data, so silent outbound sharing increases the risk of unintended disclosure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest description is written only in Chinese, which indicates a language-specific constraint without offering any user language choice or documenting that the skill is intentionally region-specific. This can violate the policy against forcing a specific language without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file contains natural-language descriptions and user-facing console output in Chinese, starting with the module docstring and continuing throughout the example. For a general-purpose skill example, this imposes a specific language/locale without any visible opt-in, fallback, or justification that the skill is intended only for Chinese-speaking users.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module title and user-facing description are entirely in Chinese, and all visible interaction strings in the demo are also fixed to Chinese. This indicates a language-specific experience without any opt-in, fallback, or justification that the skill is intended only for a Chinese-language or region-specific context.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest describes issue lifecycle management with integrations such as GitHub, GitLab, and Jira, but this example additionally reads a local config file for WeChat credentials and prepares an external notification client. While notifications are mentioned at a high level, handling local secret material and bootstrapping a separate enterprise messaging integration is a distinct capability not clearly justified by the stated purpose as presented.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This Python file contains natural-language strings and documentation in Chinese, including the module description and later user-facing print/output text, but it does not indicate that the skill is region-specific or that users can choose their preferred language. Under the policy, forcing a specific language without opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The function docstrings and descriptive text are written in Chinese throughout the file, which creates a language-specific experience without any explicit opt-in or justification. Because the file does not state a locale-limited purpose, this appears to enforce a specific language by default.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This code loads corporate ID, secret, and agent ID from a configuration file and immediately uses them to set up a notifier, which likely enables outbound network communication. While there are generic demo prints, there is no direct disclosure here that sensitive credentials are being read and used for external notification delivery.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The code sends multiple notifications for issue creation, status changes, assignment, and closure to recipient accounts. Although success/failure is printed after sending, there is no prior user disclosure that issue contents and workflow events will be transmitted to external messaging recipients.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This code sends notification content and recipient identifiers to the WeChat enterprise messaging endpoint, which is a network transmission of potentially sensitive issue data. Although the module has internal logging and docstrings, it does not include a user-facing warning or confirmation that issue details will be sent to an external service.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.