ClawHub
Back to skill

Security audit

微信公众号账号诊断与对标分析

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent WeChat public-account analysis skill, with some privacy and attribution caveats users should notice.

Before installing, be prepared to share WeChat analytics exports and possibly audience demographic screenshots. Redact unrelated account details from screenshots, avoid sharing personal data beyond aggregate metrics, and review the report template if you do not want WorkBuddy attribution or the bundled Chinese report style.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Note
Location
SKILL.md:127
Finding

Mandatory Third-Party Branding in Generated Reports

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:127-131; assets/report_template.md:104
Vulnerability Type: Output instruction hijacking through mandatory attribution
Risk Level: Low

Evidence

Translated excerpt from SKILL.md:127-131:

markdown
Integrate all analysis results into a structured report and use
`assets/report_template.md` as the output template.

The report must use HTML tags for colored headings and emphasis and remain
consistent with the style of the Qihai public account.

Translated excerpt from assets/report_template.md:104:

markdown
Report automatically generated by the WorkBuddy public-account diagnostic tool.

Technical Analysis

The Skill requires generated reports to use a bundled template containing fixed WorkBuddy attribution and separately requires reports to imitate a named public account's style. These instructions modify the agent's final output for a third party's promotional benefit rather than for the account-analysis function requested by the user.

Because use of the template is mandatory, the attribution is inserted by default without requiring informed user approval. This is an output-integrity issue matching instruction hijacking: loading and following the Skill causes otherwise user-focused results to contain externally selected branding.

Attack Path

  1. A user loads the account-audit Skill and provides analytics data.
  2. The agent follows the six-phase workflow in SKILL.md.
  3. During report generation, the agent is instructed to use assets/report_template.md.
  4. The template supplies a fixed WorkBuddy attribution.
  5. The generated report consequently promotes or attributes the output to WorkBuddy even though the user did not request that branding.

Impact Assessment

This issue does not grant operating-system privileges, access credentials, or code-execution capabilities. Its scope is limi ...[truncated 220 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the mandatory WorkBuddy attribution from assets/report_template.md.
  2. Replace the named Qihai style requirement with neutral, user-controlled formatting guidance.
  3. Make all branding and attribution explicitly opt-in.
  4. If attribution is selected, clearly preview it and allow the user to remove or replace it.
  5. Keep analytical workflow instructions separate from promotional or authorship-related content.
  6. Add a neutral default template containing no organization, product, or account branding.

T08 · Insecure Dependencies

Note
Location
scripts/parse_tendency.py:33
Finding

Unpinned Third-Party Dependency Installation Guidance

Content
View full analysis

Vulnerability Details

File Location: scripts/parse_tendency.py:33-36; scripts/parse_tendency.py:50-53
Vulnerability Type: Mutable and unverified third-party dependencies
Risk Level: Low

Evidence

python
try:
    import openpyxl
except ImportError:
    raise ImportError("openpyxl is required for .xlsx files. Install with: pip install openpyxl")
python
try:
    import xlrd
except ImportError:
    raise ImportError("xlrd is required for .xls files. Install with: pip install xlrd")

Technical Analysis

When a required Excel library is unavailable, the script instructs the user to install the package without specifying an approved version, integrity hash, lockfile, or package-index policy. Commands such as pip install openpyxl and pip install xlrd resolve mutable dependency versions at installation time.

The script does not execute these installation commands automatically, and the package names shown are not evident typosquats. The risk arises only if a user follows the guidance: the resulting installation is not reproducible and relies on the current state of the configured Python package index. A compromised upstream release, compromised configured index, or unexpectedly incompatible future release could execute code during installation or when subsequently imported.

Attack Path

  1. The user runs the parser in an environment lacking openpyxl or xlrd.
  2. Import failure exposes the unpinned installation instruction.
  3. The user runs the suggested pip install command.
  4. pip resolves a mutable package release from the environment's configured index.
  5. A compromised package release or index response is installed.
  6. Package installation hooks or later imports execute code with the privileges of the user running pip or the parser.

Impact Assessment

Successful exploitation depends on compromise or manipulation of the depend ...[truncated 399 chars]

Remediation
View remediation

Remediation Suggestions

  1. Add a reviewed dependency manifest with exact versions, such as requirements.txt or pyproject.toml plus a lockfile.
  2. Use hashes for deployment installation, for example through a hash-locked requirements file and pip install --require-hashes.
  3. Document installation from an explicitly approved package index over TLS.
  4. Review and regularly update pinned versions through a controlled dependency-update process.
  5. Replace free-form installation instructions with a reference to the reviewed dependency manifest.
  6. Install dependencies in an isolated virtual environment under a nonprivileged account.
  7. In automated environments, scan packages and verify provenance before deployment.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The supplied code only parses Excel exports and converts recognized columns into normalized JSON, with optional simple totals/averages. While this is loosely related to the declared description's mention of parsing tendency Excel data, it does not implement the core promised behavior: diagnosing a public account, identifying reader personas, performing comparative/content-direction analysis, finding benchmark accounts, or generating strategic recommendations. The primary purpose of the code is data ingestion/normalization, not the higher-level analysis tool described. Therefore the description materially overstates what the code chunk actually does.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
76% confidence
Finding

The skill references local resources and explicitly instructs generating a report from a template, while the package appears to have file-write capable code but declares no tool scope or permissions boundary. In an agent environment, missing explicit tool restrictions can let the skill write files or use broader capabilities than users expect, increasing the blast radius of prompt or workflow abuse.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Overly broad trigger phrases can cause the skill to activate in routine conversations and solicit uploads of operational data that the user did not intend to share with this workflow. In this skill, accidental invocation is more sensitive because it leads quickly to requests for analytics exports and audience demographic screenshots.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill requests user-attribute screenshots containing demographic data without giving a privacy notice, minimization guidance, or safer alternatives. Even if the data is aggregate, audience demographics can still be sensitive business and personal information, and users may overshare screenshots containing additional account details.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

This markdown template hardcodes Chinese-language headings, labels, and output text throughout the file. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.