ClawHub
Back to skill

Security audit

WeChat MP Publish Toolkit

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed WeChat publishing toolkit, but it enables scheduled public publishing with credentialed account access and has insecure credential/temp-file handling that users should review before installing.

Install only if you are comfortable giving the agent access to a WeChat Official Account AppID/AppSecret and with scheduled jobs that can publish to all subscribers. Prefer using it for draft creation unless you add an explicit approval step before freepublish/submit, keep the env file tightly permissioned, rotate credentials if logs may have captured them, and avoid shared hosts until the temp-file and command-line secret handling are fixed.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/push_draft.py:48
Finding

WeChat AppSecret Exposed Through Process Command-Line Arguments

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/push_draft.py:119
Finding

Predictable Shared Temporary File Allows Symlink Overwrite and Draft Disclosure

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (53)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The second description-behavior mismatch similarly shows that the skill advertises scheduling and auto-publish features that are not present, while also exposing additional draft-management and image-upload actions not prominently declared. Overstating some capabilities and understating others weakens user consent and security review because the real operational surface is different from the advertised one.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

The second description-behavior mismatch similarly shows that the skill advertises scheduling and auto-publish features that are not present, while also exposing additional draft-management and image-upload actions not prominently declared. Overstating some capabilities and understating others weakens user consent and security review because the real operational surface is different from the advertised one.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/automation-template.md (reported line 35)May include surrounding context.

md
Requirements:
    - curl
    - A .env file with WECHAT_APPID and WECHAT_SECRET
    - The account must be a verified enterprise/organization (freepublish permission)
"""

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/automation-template.md (reported line 83)May include surrounding context.

md
Requirements:
    - curl
    - A .env file with WECHAT_APPID and WECHAT_SECRET
    - The account must be a verified enterprise/organization (freepublish permission)
"""

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/publish_draft.py (reported line 12)May include surrounding context.

python
Requirements:
    - curl
    - A .env file with WECHAT_APPID and WECHAT_SECRET
    - The account must be a verified enterprise/organization (freepublish permission)
"""

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/publish_draft.py (reported line 25)May include surrounding context.

python
Requirements:
    - curl
    - A .env file with WECHAT_APPID and WECHAT_SECRET
    - The account must be a verified enterprise/organization (freepublish permission)
"""

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/publish_draft.py (reported line 88)May include surrounding context.

python
Requirements:
    - curl
    - A .env file with WECHAT_APPID and WECHAT_SECRET
    - The account must be a verified enterprise/organization (freepublish permission)
"""

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/push_draft.py (reported line 18)May include surrounding context.

python
Requirements:
    - curl
    - A .env file with WECHAT_APPID and WECHAT_SECRET
    - The account must be a verified enterprise/organization (freepublish permission)
"""

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/push_draft.py (reported line 30)May include surrounding context.

python
Requirements:
    - curl
    - A .env file with WECHAT_APPID and WECHAT_SECRET
    - The account must be a verified enterprise/organization (freepublish permission)
"""

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/push_draft.py (reported line 148)May include surrounding context.

python
Requirements:
    - curl
    - A .env file with WECHAT_APPID and WECHAT_SECRET
    - The account must be a verified enterprise/organization (freepublish permission)
"""

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 134)May include surrounding context.

md
# Load credentials
    creds = load_credentials(args.env)

    # Get access token
    token = get_access_token(creds["WECHAT_APPID"], creds["WECHAT_SECRET"])

    # Attempt publish with retries for transient system errors

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/publish_draft.py (reported line 96)May include surrounding context.

python
# Load credentials
    creds = load_credentials(args.env)

    # Get access token
    token = get_access_token(creds["WECHAT_APPID"], creds["WECHAT_SECRET"])

    # Attempt publish with retries for transient system errors

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill documents and encourages file access, shell execution, and outbound network/API operations but does not declare any explicit tool scope or permissions boundary. In an agent environment, this increases the chance that the skill can be invoked with broader capabilities than reviewers or users expect, enabling unintended command execution, credential file access, or external publication actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill proposes daily auto-publish automation without an explicit per-run warning that publication sends content to all subscribers and is irreversible. In this context, silent or poorly signposted automation can cause accidental mass publication, reputational damage, and dissemination of unreviewed or maliciously altered content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The documentation includes a destructive delete-draft API call without any warning, confirmation guidance, or recovery note. In a publishing automation skill, this increases the chance an agent or integrator invokes deletion unintentionally, causing content loss or workflow disruption.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-guide.md (reported line 88)May include surrounding context.

Do NOT use:

python
# WRONG — garbles Chinese
requests.post(url, json=draft_data)

DO use:

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The manifest describes a toolkit for pushing drafts and publishing to WeChat, which clearly justifies network access to WeChat APIs. However, this documentation recommends invoking an external shell utility via Python's subprocess module to perform the upload, introducing process-execution capability that is not inherently required by the stated purpose and expands the operational model beyond ordinary API usage.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-guide.md (reported line 100)May include surrounding context.

md
with open(json_path, "w", encoding="utf-8") as f:
    json.dump(draft_data, f, ensure_ascii=False, separators=(",", ":"))

# 2. Upload with curl --data-binary (preserves UTF-8 bytes)
subprocess.run([
    "curl", "-s", "-X", "POST", url,
    "-H", "Content-Type: application/json",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/automation-template.md (reported line 39)May include surrounding context.

md
### Step 4: Publish the draft
1. Get access_token:
   curl -s "https://api.weixin.qq.com/cgi-bin/token?grant_type=client_credential&appid=APPID&secret=SECRET"
2. If errcode=40164 (IP whitelist): get server IP with `curl -s https://api.ipify.org` and notify the user to add it to the whitelist.
3. Call publish API:
   curl -X POST "https://api.weixin.qq.com/cgi-bin/freepublish/submit?access_token=TOKEN" \

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/publish_draft.py (reported line 45)May include surrounding context.

python
def get_access_token(appid, secret):
    """Get WeChat access_token. Handle IP whitelist error (40164)."""
    result = subprocess.run(
        [
            "curl", "-s",
            f"https://api.weixin.qq.com/cgi-bin/token?grant_type=client_credential&appid={appid}&secret={secret}",

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/push_draft.py (reported line 50)May include surrounding context.

python
def get_access_token(appid, secret):
    """Get WeChat access_token. Handle IP whitelist error (40164)."""
    result = subprocess.run(
        [
            "curl", "-s",
            f"https://api.weixin.qq.com/cgi-bin/token?grant_type=client_credential&appid={appid}&secret={secret}",

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

The script sends WECHAT_APPID and WECHAT_SECRET to an external service by embedding them directly in the request URL query string. Even though the destination is the legitimate WeChat API and HTTPS is used, secrets in URLs are more likely to be exposed via process listings, proxies, logs, crash reports, or monitoring systems.

Content

Scanner excerpt · scripts/publish_draft.py (reported line 48)May include surrounding context.

python
result = subprocess.run(
        [
            "curl", "-s",
            f"https://api.weixin.qq.com/cgi-bin/token?grant_type=client_credential&appid={appid}&secret={secret}",
        ],
        capture_output=True,
        text=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/publish_draft.py (reported line 58)May include surrounding context.

python
errcode = data.get("errcode")
        print(f"ERROR getting access_token: {data}")
        if errcode == 40164:
            ip_result = subprocess.run(
                ["curl", "-s", "https://api.ipify.org"],
                capture_output=True,
                text=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/push_draft.py (reported line 63)May include surrounding context.

python
errcode = data.get("errcode")
        print(f"ERROR getting access_token: {data}")
        if errcode == 40164:
            ip_result = subprocess.run(
                ["curl", "-s", "https://api.ipify.org"],
                capture_output=True,
                text=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/publish_draft.py (reported line 73)May include surrounding context.

python
def publish_draft(token, media_id):
    """Call freepublish/submit to publish a draft. Returns the API response dict."""
    result = subprocess.run(
        [
            "curl", "-s", "-X", "POST",
            f"https://api.weixin.qq.com/cgi-bin/freepublish/submit?access_token={token}",

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
references/api-guide.md:14