企业微信快速集成配置

• Outcome: Review
• Latest audit: Sep 14, 2026 · 9:31 PM UTC
• Version: 1.0.0

Overview

This is a coherent WeCom integration guide, but it asks users to configure powerful messaging credentials and customer-message automation without enough security or privacy safeguards.

Install only if you are authorized to connect OpenClaw to your organization's WeCom tenant. Treat app secrets, access tokens, and webhook URLs as credentials: restrict config file permissions, do not commit or share them, redact them from logs and screenshots, and rotate them if exposed. Confirm your organization permits automated monitoring and replies for customer messages before enabling that workflow.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:43
• Finding: Plaintext Storage of WeCom Application Secrets and Webhook Credentials<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 43–51 and 119–130 **Vulnerability Type**: Plaintext sensitive credential storage in configuration **Risk Level**: Medium ### Vulnerable Code ```yaml channels: wecom: enabled: true corpId: "wx1234567890abcdef" # Enterprise ID agentId: 1000001 # Application AgentId secret: "xxxxxxxxxxxxxxxxxxxxxxxx" # Application Secret ``` ```yaml channels: wecom: enabled: true corpId: "wx1234567890abcdef" agentId: 1000001 secret: "xxx" groupBots: - name: "Development Group" webhook: "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=xxx" - name: "Operations Group" webhook: "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=yyy" ``` ### Technical Analysis The Skill instructs users to place real WeCom application secrets and webhook keys directly in `~/.openclaw/config.yml`. Although the displayed values are placeholders rather than exposed production credentials, users following the instructions would replace them with active credentials stored as plaintext. The documentation does not require restrictive file permissions, environment-variable substitution, integration with a secret manager, exclusion from version control, or credential rotation. A WeCom webhook key embedded in a URL acts as a bearer credential: possession of the complete URL may be sufficient to submit messages to the associated group. An application secret may also be exchanged for an access token within the permissions assigned to the WeCom application. This weakness becomes exploitable if the configuration is readable by another local account or process, copied into an insecure backup, included in diagnostic output, or accidentally committed to a repository. ### Attack Path 1. An administrator follows the Skill and inserts active WeCom application secrets and webhook URLs into `~/.openclaw/config.yml`. 2. The configuration remains sto ...[truncated 1416 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace literal secret values in configuration examples with environment-variable or secret-manager references, for example: ```yaml channels: wecom: enabled: true corpId: "${WECOM_CORP_ID}" agentId: "${WECOM_AGENT_ID}" secret: "${WECOM_APP_SECRET}" groupBots: - name: "Development Group" webhook: "${WECOM_DEVELOPMENT_WEBHOOK}" ``` 2. Document secure secret injection through a supported operating-system credential store, deployment-platform secret facility, or dedicated secrets manager. 3. Require restrictive permissions for any configuration that can contain credentials: ```bash chmod 700 ~/.openclaw chmod 600 ~/.openclaw/config.yml ``` 4. Explicitly warn users not to commit configuration files, webhook URLs, access tokens, or application secrets to source control. Provide an appropriate `.gitignore` entry where relevant. 5. Ensure logs, diagnostics, and support bundles redact application secrets, access tokens, and webhook query parameters. 6. Recommend least-privilege WeCom application scopes and the narrowest necessary application visibility range. 7. Document immediate revocation and rotation procedures for exposed application secrets and webhook keys. 8. Prefer separate credentials for development, testing, and production so that exposure in one environment does not compromise the others. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill instructs users to place sensitive WeCom credentials such as CorpId, AgentId, and especially the application Secret directly into a local plaintext config file, but provides no warning about secure storage, file permissions, redaction, or accidental disclosure through backups and logs. In an integration skill, this context makes the issue more dangerous because these credentials enable message sending and API access if the host or config is exposed.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill promotes automatic monitoring and replying to customer WeCom messages without any discussion of privacy, consent, data retention, or organizational policy controls. Because this involves customer communications, the omission can lead to unauthorized processing of personal or sensitive business data and noncompliant automation.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The configuration examples include group bot webhook URLs without warning that the webhook key embedded in the URL is effectively a bearer secret. If copied into tickets, repos, chat, or screenshots, an attacker could abuse the webhook to send spoofed messages into enterprise group chats.

External Transmission

Medium

• Category: Data Exfiltration

Content

2. 确认机器人未被删除
3. 测试 URL 可达性：
   ```bash
   curl -X POST "YOUR_WEBHOOK_URL" \
     -H "Content-Type: application/json" \
     -d '{"msgtype":"text","text":{"content":"测试"}}'
   ```

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Natural-Language Policy Violations

Low

• Confidence: 83% confidence
• Finding: The description and the rest of the skill content are presented only in Chinese, and the author metadata frames it as a Chinese ecosystem skill. Under the policy rule, forcing a specific language without user choice can be a natural-language policy violation unless the locale restriction is explicitly justified.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: The description and keywords indicate the skill is targeted specifically at Chinese/WeCom usage (e.g. Chinese description text and the keyword "chinese"), but the file does not state that this locale restriction is optional or justified as a region-specific tool. Under the policy rule, forcing or implying a specific language/locale without opt-in can be a natural-language policy concern.

Static analysis

No suspicious patterns detected.