ClawHub
Back to skill

Security audit

公众号自动发布

Security checks for vulnerabilities and agentic risk

Overview

The skill is purpose-aligned for creating WeChat drafts, but its credential setup and temporary-file handling create risks that warrant Review before installation.

Install only if you are comfortable giving the skill authority to create drafts and upload materials in your WeChat Official Account. Do not put the .env source command in a persistent shell startup file; load the secret only for the publishing command, restrict the .env file permissions, and consider rotating the AppSecret if it has already been broadly exported. Treat unpublished article HTML and cover images as sensitive until the temporary-file handling is hardened.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
README.md:57
Finding

WeChat credentials are globally exported to unrelated shell processes

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:64
Finding

Predictable temporary paths allow symlink-based overwrite and content disclosure

Content
View full analysis
"$DRAFT_JSON" DRAFT_RESPONSE=$(create_draft "$TOKEN" "$DRAFT_JSON") DRAFT_MEDIA_ID=$(echo "$DRAFT_RESPONSE" | jq -r '.media_id') rm -f "$DRAFT_JSON" ``` ### Technical Analysis Files under a shared `/tmp` directory must be created atomically with unpredictable names. The cover filename is constant, while the draft filename contains only a timestamp with one-second resolution. A local attacker can therefore create a file or symbolic link at the expected path before the Skill writes to it. The draft operation uses `>` redirection, which follows symbolic links. If the predicted path is a symlink to another file writable by the publishing user, the shell truncates and overwrites that target with the generated draft JSON. The fixed cover path also creates a collision and symlink risk when the unspecified download operation follo ...[truncated 2441 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 45)May include surrounding context.

bash
cd ~/.openclaw/workspace/skills/mp-draft-push   # 进入技能目录
cp .env.example .env

编辑 .env：

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts.sh (reported line 5)May include surrounding context.

sh
# 微信公众号草稿箱发布工具 - 辅助脚本
# 使用方法: source scripts.sh

# 通过环境变量提供（推荐：使用 .env + `set -a; source .env; set +a`）

require_cmd() {
    command -v "$1" >/dev/null 2>&1 || {

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README describes the skill entirely in Chinese and states its purpose in Chinese without indicating that other languages are supported. Under the policy criteria, forcing a specific language or locale without user opt-in is a natural-language policy violation unless a justified region-specific constraint is documented.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill invokes shell capabilities (bash, curl, jq, source ./scripts.sh) and performs networked publication actions, but it does not declare any explicit tool scope or permission boundaries. This increases the risk of unintended or over-privileged execution, especially because the skill accepts caller-supplied content and file paths and may download or upload external resources during execution.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger phrases are broad enough to match common publishing requests such as '发布文章' or '推送到公众号', which could cause the skill to activate in situations where the user did not intend immediate draft publication. Because the skill performs an external side effect—uploading content to a WeChat public account—mis-triggering can lead to accidental data disclosure or unauthorized publication workflows.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The natural-language description and operational instructions are presented entirely in Chinese and imply Chinese-specific interaction behavior, while also including only a limited English trigger phrase. There is no indication that users can choose their language or that the Chinese-only behavior is an intentional, documented locale restriction.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
81% confidence
Finding

The script places WECHAT_SECRET directly in the URL query string when requesting a token. Query parameters are commonly captured by shell history, proxy logs, monitoring tools, and web server logs, increasing the chance of credential exposure even though the destination is legitimate.

Content

Scanner excerpt · scripts.sh (reported line 33)May include surrounding context.

sh
require_cmd jq   || return 1
    require_env WECHAT_APPID  || return 1
    require_env WECHAT_SECRET || return 1
    curl -s "https://api.weixin.qq.com/cgi-bin/token?grant_type=client_credential&appid=${WECHAT_APPID}&secret=${WECHAT_SECRET}" \
        | jq -r '.access_token'
}

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This shell script sends the WECHAT_APPID and WECHAT_SECRET environment variables to a remote API endpoint to obtain an access token. Although the function name and comments describe token retrieval, there is no explicit user-facing warning, confirmation, or disclosure that sensitive credentials will be transmitted over the network.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts.sh (reported line 45)May include surrounding context.

sh
local token=$1
    local image_path=$2
    curl -s -X POST \
        "https://api.weixin.qq.com/cgi-bin/material/add_material?access_token=${token}&type=image" \
        -F "media=@${image_path}"
}

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts.sh (reported line 57)May include surrounding context.

sh
local token=$1
    local image_path=$2
    curl -s -X POST \
        "https://api.weixin.qq.com/cgi-bin/material/add_material?access_token=${token}&type=image" \
        -F "media=@${image_path}"
}

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts.sh (reported line 56)May include surrounding context.

sh
require_cmd curl || return 1
    local token=$1
    local json_file=$2
    curl -s -X POST \
        "https://api.weixin.qq.com/cgi-bin/draft/add?access_token=${token}" \
        -H "Content-Type: application/json" \
        -d @"${json_file}"

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The natural-language descriptions and user-facing output are written only in Chinese, which imposes a specific language without any opt-in or alternative. The policy requires flagging language or locale constraints unless the skill offers a choice or clearly documents a justified region-specific limitation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.