Wechat Bot Starter

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 1:03 AM UTC
• Version: 1.0.0

Overview

This is a coherent WeChat bot starter guide, but users should treat chat access, automated sending, and message forwarding as sensitive.

Install only after reviewing and pinning the dependencies. Use a dedicated bot account where possible, limit the bot to intended chats, get consent before monitoring or forwarding messages, add rate limits and logging, and keep the OpenClaw API endpoint local or secured with authentication and HTTPS if remote.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:31
• Finding: Unpinned npm dependencies create a mutable supply-chain risk<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 31 **Vulnerability Type**: Unpinned third-party dependencies **Risk Level**: Medium ```bash npm install wechaty wechaty-puppet-wechat ``` ### Technical Analysis The installation command does not specify reviewed package versions or integrity values. Consequently, executing it resolves whichever releases the npm registry considers current at installation time. The installed code may differ from the code available when the Skill was audited. This is a supply-chain weakness rather than evidence that the named packages are currently malicious. Exploitation depends on a package or registry account being compromised, a malicious release being published, or dependency resolution otherwise selecting an unsafe component. ### Attack Path 1. An attacker compromises a package maintainer or registry account, or causes an unsafe release to be resolved. 2. The attacker publishes malicious code under one of the instructed package names or a transitive dependency. 3. A user follows the Skill and runs the unpinned `npm install` command. 4. npm retrieves the mutable package release and its dependency tree. 5. Malicious installation hooks or subsequently imported runtime code execute under the account running npm or the bot. ### Impact Assessment Malicious dependency code could obtain the same operating-system privileges as the user running the installation or bot. Depending on that user's environment, the code could read accessible files and credentials, alter project files, access the network, or manipulate WeChat bot messages and session data. No evidence was found that this Skill itself requests elevated privileges, installs persistence, or intentionally retrieves a malicious package. The impact is contingent on a supply-chain compromise. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin each direct dependency to an explicitly reviewed version rather than relying on the latest registry release. - Generate and commit a `package-lock.json` using a trusted registry. - Use `npm ci` for reproducible installation after providing the lockfile. - Review and constrain transitive dependencies through the lockfile. - Enable dependency vulnerability and provenance checks in CI. - Where practical, initially install with lifecycle scripts disabled and review packages that require installation hooks. - Periodically update pins through a controlled review and testing process. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:55
• Finding: Unpinned Python dependency creates a mutable supply-chain risk<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 55 **Vulnerability Type**: Unpinned third-party dependency **Risk Level**: Medium ```bash pip install itchat ``` ### Technical Analysis The command installs `itchat` without an exact version or hash. Package resolution therefore depends on mutable package-index state at the time the command is executed, preventing the audited documentation from guaranteeing which code users will install. This finding does not establish that `itchat` is malicious. Exploitation would require compromise of the package publication channel, publication of an unsafe release, or unsafe dependency resolution. ### Attack Path 1. An attacker gains control of a relevant package publication channel or causes an unsafe package release to be selected. 2. Malicious package or dependency code is published. 3. A user follows the Skill and runs `pip install itchat`. 4. pip downloads and installs the package selected at that time. 5. Malicious build, installation, or imported runtime code executes with the privileges of the user running pip or the bot. ### Impact Assessment A compromised dependency could access files, credentials, network resources, and process capabilities available to the invoking user. Because the dependency is used for WeChat automation, malicious runtime behavior could also expose message content, contacts, or authenticated session information accessible to the bot. The Skill contains no confirmed privilege-escalation mechanism, persistence mechanism, embedded malicious script, or intentional data-exfiltration endpoint. The impact remains conditional on supply-chain compromise. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Replace the floating installation command with an explicitly reviewed version pin. - Supply a locked requirements file containing hashes, and install it with hash verification enabled. - Pin and review transitive dependencies where applicable. - Configure pip to use an approved package index. - Scan dependencies for known vulnerabilities and review package ownership and release provenance before updates. - Perform dependency upgrades through a controlled process with security review and bot-functionality testing. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The example sends message text and a user identifier to an external API without any privacy notice, consent guidance, minimization, or security controls. This is dangerous because it enables silent exfiltration of private chat content and identifiers to another service, potentially violating user expectations, policy, or law if the API is remote or insufficiently protected.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill includes message forwarding and scheduled sending capabilities but does not warn that automated transmission can affect uninvolved chats, leak content to unintended recipients, or create spam/abuse risks. In a messaging bot context, these features materially increase the chance of privacy violations or account enforcement if users deploy them without consent and rate limiting.

External Transmission

Medium

• Category: Data Exfiltration

Content

@itchat.msg_register(itchat.content.TEXT)
def ai_reply(msg):
    # 发送给 OpenClaw
    response = requests.post(OPENCLAW_URL, json={
        'message': msg['Text'],
        'user_id': msg['FromUserName']
    })

• Confidence: 99% confidence
• Finding: The code performs an outbound HTTP POST containing user message content and a user identifier. Even though the sample URL is localhost, the pattern is an external transmission sink and normalizes forwarding sensitive chat data without authentication, encryption guarantees, consent handling, or data minimization; if reconfigured to a remote endpoint, exposure risk is significant.

Natural-Language Policy Violations

Low

• Confidence: 82% confidence
• Finding: The file consistently presents the skill in Chinese and does not indicate that users may choose another language or that the locale limitation is intentional and justified. Under SQP-3, forcing a specific language without user opt-in can be a natural-language policy violation.

Static analysis

No suspicious patterns detected.