T08 · Insecure Dependencies
Warning
- Location
SKILL.md:31- Finding
Unpinned npm dependencies create a mutable supply-chain risk
- Content
View full analysis
- Remediation
View remediation
Security audit
Wechat Bot Starter
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent WeChat bot starter guide, but users should treat chat access, automated sending, and message forwarding as sensitive.
Install only after reviewing and pinning the dependencies. Use a dedicated bot account where possible, limit the bot to intended chats, get consent before monitoring or forwarding messages, add rate limits and logging, and keep the OpenClaw API endpoint local or secured with authentication and HTTPS if remote.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:55- Finding
Unpinned Python dependency creates a mutable supply-chain risk
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The example sends message text and a user identifier to an external API without any privacy notice, consent guidance, minimization, or security controls. This is dangerous because it enables silent exfiltration of private chat content and identifiers to another service, potentially violating user expectations, policy, or law if the API is remote or insufficiently protected.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill includes message forwarding and scheduled sending capabilities but does not warn that automated transmission can affect uninvolved chats, leak content to unintended recipients, or create spam/abuse risks. In a messaging bot context, these features materially increase the chance of privacy violations or account enforcement if users deploy them without consent and rate limiting.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 99% confidence
- Finding
The code performs an outbound HTTP POST containing user message content and a user identifier. Even though the sample URL is localhost, the pattern is an external transmission sink and normalizes forwarding sensitive chat data without authentication, encryption guarantees, consent handling, or data minimization; if reconfigured to a remote endpoint, exposure risk is significant.
- Content
md @itchat.msg_register(itchat.content.TEXT) def ai_reply(msg): # 发送给 OpenClaw response = requests.post(OPENCLAW_URL, json={ 'message': msg['Text'], 'user_id': msg['FromUserName'] })
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The file consistently presents the skill in Chinese and does not indicate that users may choose another language or that the locale limitation is intentional and justified. Under SQP-3, forcing a specific language without user opt-in can be a natural-language policy violation.
- Content