ClawHub
Back to skill

Security audit

Wechat Mp Auto

Security checks for vulnerabilities and agentic risk

Overview

This WeChat automation skill has a coherent purpose, but it needs Review because it can affect a real WeChat account while using under-scoped credential handling, URL fetching, and hardcoded attribution behavior.

Install only if you are comfortable giving this skill WeChat account authority to upload media, create and possibly publish drafts, read account/user/analytics data, and send content to third-party research or image services. Review or change the hardcoded source URL, avoid untrusted remote image URLs, restrict local credential-file permissions, and use narrowly scoped API keys where possible.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (5)

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:169
Finding

Mandatory Unrelated Source URL Injected into Published Articles

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
src/publish.py:254
Finding

Server-Side Request Forgery Through Article Image URLs

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
src/skills/image_generator.py:258
Finding

Shared API Credentials Can Be Forwarded to Unvalidated Provider Endpoints

Content
View full analysis
Optional[Dict]: """根据模型 ID 从 OpenClaw 配置获取 provider 的 API 凭证""" try: import json # 读 credentials cred_file = Path.home() / ".openclaw" / "credentials" / "api-keys.json" if cred_file.exists(): with open(cred_file) as f: creds = json.load(f) # 读 model 配置，找 provider config_file = Path.home() / ".openclaw" / "openclaw.json" if config_file.exists(): with open(config_file) as f: config = json.load(f) providers = config.get("models", {}).get("providers", {}) for pname, pcfg in providers.items(): for m in pcfg.get("models", []): if m.get("id") == model_id: api_key = creds.get(pname, {}).get("apiKey", "") return { "provider": pname, "apiKey": api_key, "baseUrl": pcfg.get("baseUrl", ""), } ``` The key is then transmitted to the configured endpoint without validating the scheme or host: ```python api_key = creds.get("apiKey", "") # 构造请求 url = f"{base_url}{api_path}" headers = {"Content-Type": "application/json"} if auth_type == "bearer": headers["Authorization"] = f"Bearer {api_key}" elif auth_type == "api_key": headers["api-key"] = api_key payload = self._build_probe_request(provider, req_format) try: import requests logger.info(f"探测生图能力: {provider}/{model_id} -> {url}") resp = reques ...[truncated 2336 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
src/first_time_setup.py:68
Finding

WeChat AppSecret Stored Without Explicit Owner-Only Permissions

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
src/token_manager.py:78
Finding

WeChat Bearer Access Token Cached Without Explicit Restrictive Permissions

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (120)

Tainted flow: 'payload' from os.environ.get (line 144, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · src/skills/topic_research.py (reported line 150)May include surrounding context.

python
"api_key": api_key
        }

        resp = requests.post(url, json=payload, headers=headers, timeout=20)
        
        if resp.status_code == 401:
            raise ValueError("Tavily API Key 无效或已过期")

Tainted flow: 'payload' from os.environ.get (line 144, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · src/skills/topic_research.py (reported line 158)May include surrounding context.

python
"api_key": api_key
        }

        resp = requests.post(url, json=payload, headers=headers, timeout=20)
        
        if resp.status_code == 401:
            raise ValueError("Tavily API Key 无效或已过期")

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · metadata.json (reported line 28)May include surrounding context.

json
"TAVILY_API_KEY"
    ],
    "alsoReads": [
      ".env"
    ]
  },
  "paths": {

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · src/config.py (reported line 71)May include surrounding context.

python
"TAVILY_API_KEY"
    ],
    "alsoReads": [
      ".env"
    ]
  },
  "paths": {

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · src/config.py (reported line 40)May include surrounding context.

python
def get_credentials(self) -> Tuple[Optional[str], Optional[str]]:
        """
        获取凭证 - 优先级：配置文件 > 环境变量 > .env
        """
        app_id = None
        app_secret = None

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · src/config.py (reported line 70)May include surrounding context.

python
def get_credentials(self) -> Tuple[Optional[str], Optional[str]]:
        """
        获取凭证 - 优先级：配置文件 > 环境变量 > .env
        """
        app_id = None
        app_secret = None

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 142)May include surrounding context.

md
class TokenManager:
    """Access Token 管理器"""
    
    TOKEN_CACHE_FILE = Path.home() / ".cache" / "wechat-mp-auto" / "token.json"

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 285)May include surrounding context.

md
class TokenManager:
    """Access Token 管理器"""
    
    TOKEN_CACHE_FILE = Path.home() / ".cache" / "wechat-mp-auto" / "token.json"

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · src/token_manager.py (reported line 16)May include surrounding context.

python
class TokenManager:
    """Access Token 管理器"""
    
    TOKEN_CACHE_FILE = Path.home() / ".cache" / "wechat-mp-auto" / "token.json"

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · src/token_manager.py (reported line 131)May include surrounding context.

python
class TokenManager:
    """Access Token 管理器"""
    
    TOKEN_CACHE_FILE = Path.home() / ".cache" / "wechat-mp-auto" / "token.json"

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · src/token_manager.py (reported line 158)May include surrounding context.

python
class TokenManager:
    """Access Token 管理器"""
    
    TOKEN_CACHE_FILE = Path.home() / ".cache" / "wechat-mp-auto" / "token.json"

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · src/token_manager.py (reported line 164)May include surrounding context.

python
class TokenManager:
    """Access Token 管理器"""
    
    TOKEN_CACHE_FILE = Path.home() / ".cache" / "wechat-mp-auto" / "token.json"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README advertises automatic draft publishing and network-based duplicate checking but does not clearly warn that article content may be transmitted to third-party services or pushed to a WeChat public account. In an AI-orchestrated skill, this is risky because users may trigger outbound data sharing or publication effects without realizing the operational consequences.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill is presented entirely as a WeChat public-account article automation skill in Chinese, and the workflow/prompt conventions prescribe Chinese article structure, labels, and examples without offering any user language choice. This can violate language/locale policy when a skill mandates a specific language by default rather than allowing opt-in or clearly documenting a justified locale restriction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill instructs sending topics, generated content, images, and publication artifacts to third-party research, image, and WeChat services without an explicit user-facing warning or consent checkpoint. This creates a real data-handling risk because sensitive or proprietary article content may be transmitted externally unexpectedly.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The workflow directs the agent to call an undefined upload_thumb tool, creating an inconsistency between declared and expected capabilities. In practice, this can cause runtime failure, misrouting to an unintended similarly named tool, or unsafe fallback behavior by an orchestrating agent trying to satisfy the instruction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This code reads sensitive credentials from environment variables and a local .env file, which is a safety-relevant operation under the warning criteria for code files. While there are internal log messages for successful reads, there is no docstring, comment, confirmation, or user-facing disclosure warning that the skill accesses stored secrets from these sources.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

All user-facing messages and setup instructions in this file are hardcoded in Chinese, including status and prompt text. The file does not provide any language selection, fallback, or explanation that the skill is intentionally limited to a Chinese-speaking or region-specific audience.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The code stores app_secret in a plaintext JSON file under the user's home directory without any protection, permission hardening, encryption, or user warning. If the local system is compromised, backups are exposed, or file permissions are too broad, an attacker could recover the WeChat AppSecret and use it to access or abuse the associated account/API integration.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The module docstring and command descriptions are entirely in Chinese, and the tool presents its interface and status messaging in that locale only. This is a language/locale restriction in natural-language UX with no opt-in or alternative language path documented.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script automatically downloads attacker-controlled external image URLs and re-uploads them using the publisher's WeChat credentials, without explicit consent or any allowlist. This creates unannounced outbound network access, can leak operational metadata/IP, and can be abused to make the system interact with arbitrary remote hosts or relay untrusted content through the publisher account.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The method sends analytics query data to a remote endpoint via self.post(...), and similar behavior appears again for user statistics retrieval. In this file there is no confirmation prompt, logging/print statement, or explanatory comment/docstring warning that article and user analytics data will be transmitted to an external API.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The call to self.post("/cgi-bin/analysis/get_user_summary", data) fetches user-summary analytics, which can be privacy-sensitive. This file does not include any visible warning, confirmation, or explanatory documentation telling the user that account/user analytics will be requested from a remote service.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This code file contains user-facing natural-language descriptions, docstrings, log messages, and error text entirely in Chinese, such as the module description and method documentation. Under the policy rule for language/locale, forcing a specific language without user opt-in or a documented regional justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

Natural-language strings, documentation, and user-facing messages in this file are exclusively in Chinese, with no indication that users may opt into another language or locale. Under the stated policy, forcing a specific language without user choice can be a policy violation unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.