ClawHub
Back to skill

Security audit

wechat-publisher

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed WeChat publishing helper, but it can use account credentials and create WeChat drafts from broad prompts, so it needs careful review before installation.

Install only if you intentionally want an agent to manage real WeChat public-account drafts. Prefer environment variables over plaintext config files, keep AppSecret values out of shared folders and version control, verify the active account before each run, and require an explicit final command before uploading covers or creating drafts.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)

Vague Triggers

Medium
Confidence
94% confidence
Finding
The README advertises very broad trigger phrases such as '今天给公众号写一篇文章' and '查看发布情况' for a skill that can switch accounts, generate content, and publish drafts. In an agent environment, overly generic invocation language increases the chance of unintended activation and can lead to accidental content generation or publication actions against the wrong公众号, even if later steps require confirmation.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The trigger phrases include broad everyday expressions such as '今天要发公众号' and '今天要发微信', which can cause the publishing skill to activate from casual conversation rather than a deliberate request. In a skill that can read account configs, generate content, and publish drafts, accidental invocation increases the chance of unintended file access, content generation, or workflow progression.

Vague Triggers

Medium
Confidence
92% confidence
Finding
The trigger '微信发文' is ambiguous because it can refer to many WeChat-related actions, not specifically public-account article publishing. Given this skill's ability to switch accounts, access configuration files, and perform external publication steps, an unclear trigger materially raises the risk of unintended activation in the wrong context.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The guide instructs testers to copy a template into a local file and populate it with real AppID/AppSecret values, but it provides only minimal cleanup guidance and no strong controls for secure storage, file permissions, secret redaction, or use of environment-based secret management. This increases the chance of credential exposure through local backups, version control, logs, screenshots, or leftover files in a testing environment.

External Transmission

Medium
Category
Data Exfiltration
Content
Returns:
        media_id 或 None
    """
    url = f"https://api.weixin.qq.com/cgi-bin/draft/add?access_token={access_token}"

    data = {
        "articles": [article_data]
Confidence
92% confidence
Finding
The code embeds the access token directly in the request URL query string when calling the draft API. Secrets placed in URLs are commonly exposed through logs, proxies, crash reports, browser/history tooling, or monitoring systems, which can lead to token disclosure and unauthorized API use. In a publishing skill, leaked tokens could allow posting or modifying content for managed public accounts.

Credential Access

High
Category
Privilege Escalation
Content
if 'access_token' in data:
            # 不打印完整token，只显示前10个字符
            token_preview = data['access_token'][:10] + "****"
            print(f"✅ Access Token获取成功: {token_preview}")
            return data['access_token']
        else:
            error_msg = data.get('errmsg', '未知错误')
Confidence
90% confidence
Finding
The script prints a preview of the access token to stdout. Even partial secret disclosure increases exposure because logs are often centralized and accessible to operators or other systems; partial values can aid correlation, debugging misuse, or accidental leakage across trust boundaries. In a multi-account WeChat publishing context, token traces may reveal which account is active and weaken secret-handling hygiene.

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.28.0
playwright>=1.30.0
python-dotenv>=1.0.0
Confidence
93% confidence
Finding
The dependency is specified with a lower bound only (`requests>=2.28.0`), which allows installation of any future version, including breaking or newly vulnerable releases. This weakens build reproducibility and supply-chain control, especially for a skill that handles publication workflows and may process credentials or network requests.

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.28.0
playwright>=1.30.0
python-dotenv>=1.0.0
Confidence
93% confidence
Finding
`playwright>=1.30.0` is unpinned, so deployments may resolve to different versions over time. That creates non-reproducible builds and increases supply-chain risk because security posture can change without code changes.

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.28.0
playwright>=1.30.0
python-dotenv>=1.0.0
Confidence
92% confidence
Finding
`python-dotenv>=1.0.0` is not pinned to a deterministic version, so future installs may pull in unexpected releases. This is a supply-chain hygiene issue that can introduce regressions or newly disclosed vulnerabilities into environments that may hold publishing credentials or API secrets.

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High
Category
Supply Chain
Confidence
96% confidence
Finding
The requirement permits vulnerable `requests` versions because `>=2.28.0` does not exclude releases affected by known advisories, including recent credential-leak and TLS/verification issues. In a WeChat publishing skill that likely performs outbound HTTP requests and may use tokens, cookies, or session credentials, this increases the chance of sensitive data exposure or request security bypass.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.