ClawHub
Back to skill

Security audit

Weiyun Skills

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its Weiyun cloud-drive purpose, but it asks the agent to trust remote update instructions and includes a debug URL override that can redirect tokens and uploaded file contents if enabled.

Review before installing. Use it only when you intend to give an agent access to your Weiyun files, including upload, download, sharing, moving, renaming, and deletion. Do not enable WEIYUN_MCP_URL_ALLOW_INSECURE with real tokens or real files. Prefer environment variables over command-line tokens, avoid shared machines, and require explicit confirmation for delete, public share links, and uploads of local files. Treat remote update instructions as untrusted text unless you separately verify the update source.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:31
Finding

Untrusted Remote Update Instructions Can Hijack Agent Behavior

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 31-49
Vulnerability Type: Remote instruction injection into the Agent execution flow
Risk Level: Critical

Vulnerable Code Snippet

markdown
mcporter call "https://www.weiyun.com/api/v3/mcpserver" "check_skill_update" --args '{"version": "当前版本"}'
markdown
| `latest` | string | 最新版本号，格式为 MAJOR.MINOR.PATCH |
| `release_note` | string | 最新版本发布说明 |
| `instruction` | string | 更新指令 |
markdown
如果当前版本 `version` 低于最新版本 `latest`，则遵循 `instruction` 指令进行更新，或提示用户更新。

The final source instruction means that, when the remote version is newer, the Agent should follow the remotely returned instruction field or ask the user to update.

Technical Analysis

The Skill mandates a daily call to a remote MCP endpoint and treats the response's free-form instruction field as trusted Agent guidance. The response is not constrained to a predefined update action, verified against an allowed command schema, authenticated through a signed release manifest, or subjected to explicit user approval before execution.

HTTPS protects the connection in transit but does not make arbitrary server-generated instructions safe. A compromised endpoint, compromised provider account, malicious backend response, or upstream service defect could change the effective behavior of the already-reviewed Skill without modifying its local files.

This exceeds the minimum privilege needed for checking whether a newer version exists. A version check only needs to return a version number, release metadata, and a fixed trusted download reference; it does not need authority to issue arbitrary instructions to the Agent.

Attack Path

  1. The Agent loads the Skill and performs the mandatory daily update check.
  2. An attacker compromises the update service or otherwise gains control over its response.
  3. The response reports a version greater than 1.0.10.
  4. The attac ...[truncated 1079 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the requirement to follow the free-form instruction field automatically.
  2. Treat instruction and release_note as untrusted display-only text.
  3. Restrict the response schema to inert data such as a semantic version, release identifier, cryptographic digest, and fixed HTTPS download URL.
  4. Use signed release manifests and verify the signature against a public key embedded in the reviewed Skill.
  5. Require explicit user confirmation before downloading, installing, or replacing any Skill files.
  6. Implement updates through a fixed local updater with strict hostname, path, package-name, version, and digest validation.
  7. Never pass remote response text to a shell, command executor, package manager, or general Agent instruction context.
  8. Pin the expected MCP method and response types, rejecting unexpected fields and malformed semantic versions.

T09 · Insecure Skill Coding Practices

Error
Location
scripts/upload_to_weiyun.py:99
Finding

Debug URL Override Can Exfiltrate Weiyun Credentials and Uploaded Files

Content
View full analysis

Vulnerability Details

File Location: scripts/upload_to_weiyun.py, lines 99-109, 296-313, 422-432, and 485-503
Vulnerability Type: Security-control bypass through an environment variable
Risk Level: High

Vulnerable Code Snippet

python
if allow_insecure:
    print(
        f"[security] ⚠️ WEIYUN_MCP_URL_ALLOW_INSECURE=1 已开启，"
        f"放行非受信任的 MCP URL: {url}（仅用于本地调试，"
        f"请勿在生产 / 共享环境中使用）",
        file=sys.stderr,
    )
    return url
python
safe_mcp_url = _validate_mcp_url(
    mcp_url,
    allow_insecure=(os.environ.get("WEIYUN_MCP_URL_ALLOW_INSECURE") == "1"),
)
python
resp = requests.post(safe_mcp_url, headers=headers, json=payload, timeout=120)
python
chunk = file_data[offset:offset + actual_len]
chunk_b64 = base64.b64encode(chunk).decode("utf-8")
python
mcp_url = args.mcp_url or os.environ.get(
    "WEIYUN_MCP_URL",
    "https://www.weiyun.com/api/v3/mcpserver"
)
mcp_token = args.token or os.environ.get("WEIYUN_MCP_TOKEN")
env_id = args.env_id or os.environ.get("WEIYUN_ENV_ID")
python
allow_insecure = os.environ.get("WEIYUN_MCP_URL_ALLOW_INSECURE") == "1"
try:
    mcp_url = _validate_mcp_url(mcp_url, allow_insecure=allow_insecure)
except ValueError as e:
    print(f"错误：{e}", file=sys.stderr)
    sys.exit(2)

headers = {
    "Content-Type": "application/json",
    "WyHeader": f"mcp_token={mcp_token}",
}

Technical Analysis

Under normal operation, _validate_mcp_url requires HTTPS and limits destinations to weiyun.com or qq.com. However, setting WEIYUN_MCP_URL_ALLOW_INSECURE=1 bypasses both the transport-security requirement and trusted-host restriction. The override accepts an arbitrary HTTP or HTTPS destination.

The destination URL and override are both obtained from environment variables, a boundary that may be influenced by CI configuration, wrapper scripts, parent proc ...[truncated 2374 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove WEIYUN_MCP_URL_ALLOW_INSECURE from production distributions.
  2. Preserve mandatory HTTPS and the trusted-host allowlist immediately before every request.
  3. If a development override is essential, restrict it to literal loopback destinations such as 127.0.0.1 and ::1; do not permit arbitrary hostnames or external IP addresses.
  4. Refuse to send production tokens or real file contents whenever development mode is enabled.
  5. Require a separate test-token variable and verify that production credential variables are absent in development mode.
  6. Require explicit interactive confirmation that identifies the exact destination and file before any debug upload.
  7. Consider certificate pinning or stronger endpoint identity verification for the production MCP service.
  8. Prevent untrusted wrapper scripts and CI inputs from controlling security-sensitive environment variables.
  9. Add automated tests proving that arbitrary domains, plain HTTP endpoints, user-info URL tricks, suffix-confusion domains, and redirect-based destination changes are rejected.
  10. Disable or strictly validate redirects so credentials cannot be forwarded from an approved hostname to an unapproved destination.

T09 · Insecure Skill Coding Practices

Note
Location
scripts/upload_to_weiyun.py:511
Finding

Partial MCP Token Is Exposed in Terminal and Automation Logs

Content
View full analysis

Vulnerability Details

File Location: scripts/upload_to_weiyun.py, line 511
Vulnerability Type: Sensitive credential fragment disclosure
Risk Level: Low

Vulnerable Code Snippet

python
print(f"Token:    {mcp_token[:8]}...{mcp_token[-4:]}")

Technical Analysis

The script prints the first eight and last four characters of the MCP token. Although this is not the complete credential, the output can be retained in shell transcripts, CI logs, Agent tool-call records, support bundles, or centralized logging systems.

Partial credential exposure reduces the token's unknown search space and supplies a stable identifier that can be used to correlate activity across systems and sessions. It also conflicts with the documentation's recommendation not to output or echo the token.

Displaying any token characters is unnecessary for the upload operation and therefore exceeds minimum disclosure requirements. A boolean status such as Token: configured provides sufficient diagnostic value.

Attack Path

  1. A user or Agent invokes the upload script with a valid MCP token.
  2. Standard output is captured by a terminal logger, CI system, Agent execution transcript, or monitoring service.
  3. The output records twelve characters from the credential.
  4. A party with log access obtains the token prefix and suffix.
  5. The fragment is used to correlate the credential with other leaks, identify token reuse, or reduce the effort required to reconstruct a token when combined with another partial disclosure.

Impact Assessment

This issue does not independently reveal the complete token and does not by itself establish direct account compromise. Its impact is primarily increased credential-correlation capability, reduced secret entropy if brute-force or reconstruction is otherwise feasible, and unnecessary persistence of sensitive metadata in logs.

If combined with another partial leak, weak token generation, or ...[truncated 192 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove all output containing token substrings.
  2. Replace the line with a non-sensitive status message such as Token: configured.
  3. Ensure exception messages and HTTP diagnostics do not serialize request headers.
  4. Add a logging redaction filter for WyHeader, mcp_token, and related credential variables.
  5. Add tests that run the script with a sentinel token and verify that no portion of the sentinel appears in standard output or standard error.
  6. Advise users to rotate tokens if historical logs containing token fragments were broadly accessible or combined with other credential disclosures.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
Findings (20)

Tainted flow: 'safe_mcp_url' from os.environ.get (line 300, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/upload_to_weiyun.py (reported line 313)May include surrounding context.

python
"method": "tools/call",
            "params": {"name": tool_name, "arguments": arguments},
        }
        resp = requests.post(safe_mcp_url, headers=headers, json=payload, timeout=120)
        resp.raise_for_status()
        result = resp.json()
        content = result.get("result", {}).get("content", [])

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

There is a clear description-to-code mismatch. The declared purpose describes a full-featured Weiyun MCP integration with numerous tools and FTN-related hashing support. The actual code chunk contains only a single placeholder comment for an encoding-fix module and shows no implementation related to Weiyun, MCP tools, file management, sharing, uploads, downloads, or SHA1 chunk computation. This is not a minor omission or supporting utility; the code’s primary purpose is materially different and unrelated to the declared functionality.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

该描述与代码存在明显范围不一致。代码确实覆盖了声明中“FTN 上传协议所需的 SHA1 分块计算脚本”和“微云上传”的一部分，并且通过 weiyun.upload 完成预上传和分片上传流程；因此它与上传相关内容是相符的。但声明强调这是一个“完整技能”，包含 12 个 MCP Tool 的使用指南和广泛的微云文件管理能力，而给出的代码块仅是 upload_to_weiyun.py，一个面向本地文件上传的命令行脚本。它没有实现、调用或说明 weiyun.list、list_by_category、download、delete、gen_share_link、rename_file、rename_dir、create_dir、move_dir、move_file、check_skill_update 等其他能力。根据评估标准，这属于声明能力显著多于代码实际行为，且主功能范围 materially narrower，因此应判定为不匹配。

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill documents capabilities that involve network access, environment variable access, and local command execution, but the manifest does not declare any explicit tool scope or restrictions. This weakens policy enforcement and makes it easier for an agent to invoke powerful side effects without clear least-privilege boundaries.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger conditions include broad phrases like cloud upload, file management, and related tool names, which can cause the skill to activate in contexts the user did not intend. Because the skill can lead to command execution, network requests, deletion, sharing, and uploads, overbroad triggering increases the chance of unsafe or privacy-impacting actions being suggested or invoked.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill requires a daily remote version check and then tells the agent to follow server-provided 'instruction' content. This is effectively remote instruction injection: a network response can influence future agent behavior, including update actions, without independent validation or allowlisting.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill instructs the agent to use execute_command to run local Python scripts against user-specified files while also reading environment variables such as tokens. That creates a strong side-effect channel from chat instructions to local file access and secret-bearing environment access, which can lead to unintended exfiltration or over-collection if the path or target is wrong.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The instruction requires the user to confirm with specific Chinese phrases such as "已授权" and "已完成授权" before proceeding. This imposes a language-specific interaction pattern without any opt-in or alternative-language accommodation, which is a natural-language policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The template tells the user to reply specifically with the Chinese phrase "已完成授权" to continue. Because no language alternatives or opt-in are offered, the skill forces a specific language for interaction, which violates the language/locale policy criteria.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/mcp_api.md (reported line 13)May include surrounding context.

md
查询微云网盘的目录内容，支持按目录查看文件和子目录，支持分页和排序。

### 请求（McpListReq）

| 字段 | 类型 | 必填 | 说明 |
|------|------|------|------|

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/mcp_api.md (reported line 25)May include surrounding context.

md
查询微云网盘的目录内容，支持按目录查看文件和子目录，支持分页和排序。

### 请求（McpListReq）

| 字段 | 类型 | 必填 | 说明 |
|------|------|------|------|

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/mcp_api.md (reported line 68)May include surrounding context.

md
查询微云网盘的目录内容，支持按目录查看文件和子目录，支持分页和排序。

### 请求（McpListReq）

| 字段 | 类型 | 必填 | 说明 |
|------|------|------|------|

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/mcp_api.md (reported line 81)May include surrounding context.

md
查询微云网盘的目录内容，支持按目录查看文件和子目录，支持分页和排序。

### 请求（McpListReq）

| 字段 | 类型 | 必填 | 说明 |
|------|------|------|------|

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The document exposes a bulk delete capability, including permanent deletion via delete_completely=true, but does not state that callers should require explicit user confirmation before invoking it. In an agent skill context, this omission is risky because an LLM-driven agent may execute destructive actions from ambiguous or indirect prompts, causing irreversible data loss.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The document provides share-link generation for files and directories without warning that this creates an externally accessible link and may expose private data beyond the user's account. In an agent workflow, lack of a privacy warning increases the chance of accidental data disclosure if a model generates a share link instead of a safer local operation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

All user-facing instructional content in the file is written in Chinese, with no indication that the skill is region-specific or that users may choose another language. Under the stated policy, forcing a specific language without opt-in can constitute a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The usage examples encourage passing the MCP token directly on the command line. On many systems, command-line arguments can be exposed via shell history, process listings, audit logs, or CI job output, which can leak the credential to other local users or logging systems.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/upload_to_weiyun.py (reported line 313)May include surrounding context.

python
"method": "tools/call",
            "params": {"name": tool_name, "arguments": arguments},
        }
        resp = requests.post(safe_mcp_url, headers=headers, json=payload, timeout=120)
        resp.raise_for_status()
        result = resp.json()
        content = result.get("result", {}).get("content", [])

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The manifest says '共 12 个 MCP Tool', and the body repeats '包含 12 个 MCP Tool', but the enumerated set is 11 weiyun.* tools plus check_skill_update. This is an intent/documentation inconsistency that can mislead auditors or users about the actual exposed interface.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

This markdown file instructs users to run a one-click upload script with a file path and MCP token, which implies transmission of file contents and use of credentials. The document explains the protocol mechanics but does not include a user-facing warning about privacy, network transfer, or careful handling of the token.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.secret_argv_exposure

Instructions pass high-value credentials through process argv.

Critical
Code
suspicious.secret_argv_exposure
Location
references/upload_protocol.md:145

Instructions pass high-value credentials through process argv.

Critical
Code
suspicious.secret_argv_exposure
Location
SKILL.md:404