ClawHub
Back to skill

Security audit

WeChat Video Downloader

Security checks for vulnerabilities and agentic risk

Overview

This skill appears intended to download WeChat article videos, but its URL and output-file handling are too broad for that purpose.

Review this before installing if you expect strict WeChat-only behavior. Use it only with trusted mp.weixin.qq.com article links, avoid passing absolute or traversal output paths, and prefer a patched version that restricts allowed hosts, blocks private-network targets and redirects, confines downloads to a dedicated folder, and refuses overwrites by default.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/download_wechat_video.py:95
Finding

Unrestricted URL Handling Enables Server-Side Request Forgery

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/download_wechat_video.py:168
Finding

Caller-Controlled Output Path Allows Arbitrary Writable-File Overwrite

Content
View full analysis
2 else None success = download_wechat_video(article_url, output_filename) ``` The destination is ultimately passed to `curl -o`, which can replace an existing writable file: ```python cmd = [ "curl", "-L", "-o", output_path, "-H", f"User-Agent: {user_agent}", "-H", f"Referer: {referer}", "-H", "Accept: video/webm,video/ogg,video/mp4,application/octet-stream", "--progress-bar", video_url ] ``` ### Technical Analysis `Path.resolve()` normalizes a path but does not make it safe. Absolute paths and traversal paths can resolve outside the intended working directory. The script neither confines output to a dedicated download directory nor rejects existing files or symbolic-link destinations. When the resulting path is passed to `curl -o`, an existing file writable by the process may be truncated and replaced with downloaded content. The script runs with the invoking user's permissions, so the affected scope includes files writable by that user or service account. This is not shell command injection because `subprocess.run` receives an argument list. The security issue is unrestricted filesystem destination selection. ### Attack Pa ...[truncated 1097 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The entire skill description is written in Chinese, including operational instructions and warnings, with no indication that other languages are supported or that Chinese is a required locale for compliance or regional scope. Under the policy for natural-language violations, forcing a specific language without user opt-in is a reportable issue.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill invokes shell commands and a local Python script but declares no explicit tool scope or permission boundaries. In an agent environment, this can enable broader-than-expected command execution, making accidental or unsafe invocation easier and reducing auditability of what the skill is allowed to do.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The trigger phrase includes the very broad term '下载视频', which can match many unrelated user requests and cause this skill to activate unexpectedly. Because the skill performs shell execution and downloads remote content, mis-triggering increases the chance of unintended network access, file writes, or use on non-WeChat URLs if routing is imperfect.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/download_wechat_video.py (reported line 31)May include surrounding context.

python
else:
                cmd.append(f"--{key}={value}")
    
    result = subprocess.run(cmd, capture_output=True, text=True)
    if result.returncode != 0:
        print(f"浏览器命令失败：{result.stderr}")
        return None

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/download_wechat_video.py (reported line 81)May include surrounding context.

python
]
    
    print(f"开始下载视频到：{output_path}")
    result = subprocess.run(cmd)
    
    if result.returncode == 0:
        file_size = os.path.getsize(output_path)

Static analysis

No suspicious patterns detected.