ClawHub
Back to skill

Security audit

wechat-style-publisher

Security checks across malware telemetry and agentic risk

Overview

The skill matches its WeChat publishing purpose, but it needs review because it can use account credentials, cache access tokens, and upload local content to WeChat with limited safeguards.

Install only if you trust the workspace and need automated WeChat draft/material creation. Keep app secrets and the .tokens directory out of shared folders and version control, use least-privileged WeChat credentials, verify selected accounts before running, inspect article/template HTML for unexpected local image paths, and avoid importing templates from untrusted URLs.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
This skill is specifically designed to use account-specific credentials to publish content to external WeChat public accounts, yet the description does not warn that local credentials/configuration will be used and that article content and assets will be transmitted to third-party services. In practice, this can lead to unintended publication, accidental disclosure of sensitive content, or unsafe handling of privileged account tokens because users are not adequately informed at invocation time.

Missing User Warnings

Low
Confidence
92% confidence
Finding
The script fetches arbitrary user-supplied URLs with httpx.get(), which creates an SSRF-capable network primitive if this skill is exposed through an agent or automation layer. In this skill context, importing templates from remote WeChat articles is expected behavior, but allowing unrestricted URLs can let an attacker probe internal services, access cloud metadata endpoints, or exfiltrate data from networks reachable by the runtime.

Missing User Warnings

Low
Confidence
87% confidence
Finding
The script writes imported HTML, CSS, analysis JSON, and registry content to user-controlled filesystem paths without validation. In an agent setting, this can be abused for arbitrary file overwrite within the permissions of the running process, potentially clobbering configuration files, planting content in served directories, or corrupting application state.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"node": ">=18"
  },
  "dependencies": {
    "highlight.js": "^11.11.1",
    "juice": "^11.0.3"
  }
}
Confidence
92% confidence
Finding
"highlight.js": "^11.11.1"

Unpinned Dependencies

Low
Category
Supply Chain
Content
},
  "dependencies": {
    "highlight.js": "^11.11.1",
    "juice": "^11.0.3"
  }
}
Confidence
92% confidence
Finding
"juice": "^11.0.3"

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/publish-node.mjs:106