T09 · Insecure Skill Coding Practices
Error
- Location
src/outbound.ts:620- Finding
Model-Controlled MEDIA Directives Can Exfiltrate Arbitrary Local Files
- Content
View full analysis
- Remediation
View remediation
Security audit
Huo15 Wecom Plugin
Security checks for vulnerabilities and agentic risk
Overview
This WeCom plugin is broadly functional but needs Review because it can read and send local files, mutate business documents/calendars, and persist new agent configuration with incomplete safeguards.
Install only if you trust the WeCom workspace, credentials, and users who can influence the agent. Prefer disabling dynamicAgents until explicitly configured, narrowing media localRoots to a dedicated staging directory, avoiding broad home-folder access, requiring human confirmation before file uploads or delete operations, and upgrading vulnerable dependencies before production use.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
src/capability/doc/tool.ts:1578- Finding
WeCom Document Tool Accepts Unrestricted Local File Paths for Upload
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
src/capability/doc/tool.ts:461- Finding
Document Initialization Supports Unrestricted Local Reads and Server-Side Request Forgery
- Content
View full analysis
=> { const isLocalFile = !imageSource.startsWith("http") && !imageSource.startsWith("data:"); if (isLocalFile) { const fs = await import("fs"); const path = await import("path"); const absolutePath = path.isAbsolute(imageSource) ? imageSource : path.join(process.cwd(), imageSource); if (!fs.existsSync(absolutePath)) { throw new Error(`Local image file not found: ${absolutePath}`); } const fileBuffer = fs.readFileSync(absolutePath); return fileBuffer.toString("base64"); } else if (imageSource.startsWith("data:")) { const matches = imageSource.match( /^data:image\/(?:png|jpeg|gif|webp);base64,(.*)$/, ); if (matches && matches[1]) { return matches[1]; } throw new Error("Invalid data URL format"); } else { console.log( `[wecom-doc] Downloading remote image: ${imageSource.substring(0, 50)}...`, ); const response = await fetch(imageSource, { signal: AbortSignal.timeout(10000), }); if (!response.ok) { throw new Error( `Failed to download image: ${response.status} ${response.statusText}`, ); } const arrayBuffer = await response.arrayBuffer(); return Buffer.from(arrayBuffer).toString("base64"); } }; ``` ### Technical Analysis The document creation flow can obtain image content from either a local path or a URL. Both branches lack critical controls. For local files: - Absolute paths are accepted. - Relative paths are resolved from the process working directory. - There is no allowed-root validation. - Symlinks and non-regular files are not rejected. - Image format and size are not verified. For remote URLs: - Raw `fetch()` is us ...[truncated 1870 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
src/dynamic-agent.ts:390- Finding
Dynamic Agent Provisioning Persistently Modifies Configuration and Copies Identity Files by Default
- Content
View full analysis
} } })?.channels?.wecom?.dynamicAgents; const mainWorkspaceFromAgents = (config as { agents?: { defaults?: { workspace?: string } } })?.agents?.defaults?.workspace; return { enabled: dynamicAgents?.enabled ?? true, dmCreateAgent: dynamicAgents?.dmCreateAgent ?? true, groupEnabled: dynamicAgents?.groupEnabled ?? true, adminUsers: dynamicAgents?.adminUsers ?? [], workspaceTemplate: dynamicAgents?.workspaceTemplate?.trim() || DEFAULT_WORKSPACE_TEMPLATE, agentDirTemplate: dynamicAgents?.agentDirTemplate?.trim() || DEFAULT_AGENT_DIR_TEMPLATE, maxAgents: typeof dynamicAgents?.maxAgents === "number" && dynamicAgents.maxAgents > 0 ? Math.floor(dynamicAgents.maxAgents) : DEFAULT_MAX_AGENTS, seedFromMainWorkspace: dynamicAgents?.seedFromMainWorkspace ?? true, seedFiles: Array.isArray(dynamicAgents?.seedFiles) && dynamicAgents.seedFiles.length > 0 ? dynamicAgents.seedFiles : DEFAULT_SEED_FILES, mainWorkspacePath: dynamicAgents?.mainWorkspacePath || mainWorkspaceFromAgents, }; } ``` Identity and instruction files are copied into newly created workspaces: ```ts async function seedWorkspaceFromMain(p ...[truncated 5438 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (179)
Known Vulnerable Dependency: fast-xml-parser==5.3.4 — 6 advisory(ies): CVE-2026-33036 (fast-xml-parser affected by numeric entity expansion bypassing all entity expans); CVE-2026-27942 (fast-xml-parser has stack overflow in XMLBuilder with preserveOrder); CVE-2026-41650 (fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimi) +3 more
Critical
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The manifest pins fast-xml-parser to 5.3.4, and the finding indicates that exact version is associated with multiple known advisories, including entity expansion bypass and XMLBuilder injection issues. For a WeCom integration plugin that is likely to parse or generate XML in message-handling paths, this materially increases risk of denial of service, malformed message generation, or injection depending on how the library is used.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description presents a runtime WeCom integration plugin with messaging/media features. The supplied code chunk does not implement WeCom connectivity, Bot WebSocket handling, media decryption, message routing, customer service channels, or multi-account behavior. Instead, it is a release.sh script for package release operations: checking git branch/status, verifying version alignment across package.json/SKILL.md/CHANGELOG, running tsc, checking package metadata, creating/pushing tags, and publishing to npm and ClawHub. This is a materially different primary purpose and includes undeclared capabilities related to release engineering and external publishing services.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents a full-featured WeCom/OpenClaw integration plugin with messaging, media handling, customer service channels, and account switching. The supplied code chunk does not implement those behaviors; instead, it is a diagnostic CLI script for testing HTTP proxy connectivity. It accesses httpbin.org and the WeCom API only to verify network routing, not to provide the declared WeCom bot/application integration features. This is a materially different primary purpose, so it should be flagged as a mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The supplied code does not implement the declared messaging/media/customer-service bot functionality. Instead, it is a dedicated calendar/scheduling client that calls enterprise WeCom OA calendar endpoints. This is a materially different primary purpose and adds undeclared capabilities related to calendars and schedules. While both concern WeCom, the described plugin emphasizes bot WebSocket transport, media direct-send/link fallback behavior, active messaging, and customer-service channels; none of those behaviors appear in this code chunk. Therefore the description does not accurately represent this code.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The description emphasizes a WeCom messaging/OpenClaw plugin with bot connectivity, media handling, proactive messaging, customer service integration, and account switching. The supplied code chunk, however, is a calendar module export and does not reflect those messaging-focused capabilities. Even though both are within a broader WeCom domain, the specific capability shown in code is calendar-related and undeclared, making this a description-behavior mismatch for the provided chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description emphasizes messaging-channel functionality for Enterprise WeChat: Bot WebSocket transport, media/file sending behavior, media decryption, customer-service ingress, proactive app messaging, and account switching. The supplied code chunk does not implement or describe those behaviors. Instead, it defines validation schemas for a separate calendar capability, covering calendar CRUD, schedule CRUD, attendee operations, reminders, recurrence options, and system calendar creation. This is a materially different primary purpose and introduces undeclared capabilities related to calendaring. There is no evidence in this chunk of bot WebSocket handling, media decryption, file delivery routing, customer-service channels, or message sending logic. Therefore the description does not accurately represent this code chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The supplied code chunk does not implement the messaging/media/customer-service capabilities emphasized in the declared description. Instead, its primary function is a calendar tool for enterprise WeChat, exposed only in WeCom agent contexts and backed by calendar/schedule API calls. This is a materially different capability set from Bot WebSocket access, media handling, proactive agent messaging, and multi-channel customer service integration. While both relate to WeCom, the specific behavior in this code chunk is undeclared and unrelated to the stated primary purpose, so this is a clear description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The declared description emphasizes enterprise WeCom bot connectivity, WebSocket transport, media decryption, proactive agent messaging, customer-service channels, and account switching. The supplied code does not implement or support those behaviors directly; instead, it defines interfaces and constants for calendar-related operations such as creating/updating calendars, creating/updating schedules, attendee responses, syncing schedules, and callback events for calendar changes. While this could belong to a larger WeCom plugin, this specific chunk’s actual purpose is calendar/scheduling type definitions, which is a materially different capability from the declared messaging/media-focused description and is undeclared here.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared description presents a messaging-channel integration plugin for Enterprise WeChat/WeCom bots, agent push messaging, customer-service channels, media handling, and account switching. However, this code chunk is not about message transport or bot websocket behavior. It is a dedicated client for WeCom document-related APIs (
/cgi-bin/wedoc/...and related endpoints), including documents, spreadsheets, forms, smart tables, sharing, permissions, record operations, and content updates. While both are within the broader WeCom ecosystem, the primary purpose and concrete capabilities of this code are materially different from the declared purpose. Therefore this chunk indicates undeclared capabilities and a description-behavior mismatch.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
This code is not about Bot WebSocket transport, media decryption, agent proactive messaging, or WeChat customer-service channel handling. Instead, it exposes schemas for enterprise document operations in WeCom: document CRUD, sharing/auth, content batch updates, forms/statistics, spreadsheet editing, and smart-table/view/field/permission management. While the declared description mentions a general WeCom plugin and multi-account switching, its detailed primary purpose is messaging/channel integration; this chunk implements a separate doc-management capability that is undeclared. Therefore the description does not accurately represent what this supplied code chunk actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
The declared description presents a WeCom connector plugin centered on messaging transport and media delivery behavior (Bot WebSocket, media send strategy, active agent messaging, WeChat customer service channels, multi-account switching). In contrast, the supplied code chunk is specifically a document capability module (
wecom_doc) that operates on WeCom Docs, spreadsheets, forms, and smart tables. It creates, renames, copies, deletes, shares, edits content, manages permissions, inspects share links, and uploads images. It also reads local files and fetches remote URLs/HTML for image import and share-link diagnosis. These are substantive capabilities and a different primary functional area than the declared messaging/media integration focus. While both belong to the broader WeCom ecosystem, this chunk's behavior is materially underrepresented by the declared description, so this is a mismatch.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description focuses on enterprise WeCom integration features: bot WebSocket access, encrypted media decryption, proactive agent messaging, WeChat customer service channels, multi-account switching, and media/link routing behavior. The actual code chunk does none of that. It does not interact with WeCom APIs, messaging channels, media, accounts, networking, or bot logic. Instead, it is an internal schema-processing helper for Gemini compatibility. This is a materially different purpose, not merely an implementation detail supporting the stated WeCom functionality. Therefore the description does not accurately represent this code chunk.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Local Node.js/Python execution is a context-expanding capability that goes beyond ordinary WeCom integration because external events can now trigger logic on the host system. In this skill context, that is more dangerous because WeCom menu and event traffic may be influenced by users or admins, turning a messaging integration into a potential remote code execution bridge if misconfigured.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documentation states that the image loader accepts local file paths as well as URLs, but provides no warning that local files may be read and transmitted onward. In a messaging integration that processes content automatically, this can lead to local file exfiltration if an attacker can influence the supplied path or markdown image source, making the skill context materially more dangerous because it bridges local filesystem access to outbound messaging.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
[ -f "$MAIN/$f" ] && [ ! -f "$ws/$f" ] && cp "$MAIN/$f" "$ws/$f" && echo "seeded: $ws/$f" done
删 BOOTSTRAP.md（已派生 workspace 残留的引导脚本）
[ -f "$ws/BOOTSTRAP.md" ] && rm "$ws/BOOTSTRAP.md" && echo "removed BOOTSTRAP: $ws" done
text
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README states that common local user directories such as Desktop, Documents, Downloads, Movies, and Pictures are allowed by default for media sending. In a plugin that can read local files and transmit them to Enterprise WeCom, this weakens least-privilege boundaries and increases the chance of accidental exfiltration of sensitive personal or corporate data, especially because users may not realize these directories are implicitly trusted.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill advertises installation and runtime behavior that clearly relies on network access and likely secrets/environment-backed configuration, but it declares no explicit tool/permission scope. This weakens least-privilege guarantees and can mislead operators about what the skill is allowed to do, increasing the chance of overbroad execution in a privileged environment.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The skill explicitly states it decrypts media and makes readable buffers available to agents for OCR, ASR, and document parsing, but it does not prominently warn operators that sensitive user content becomes accessible in plaintext within the agent pipeline. This can lead to accidental overexposure of confidential files, voice data, or images to downstream models, logs, or plugins.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The documented design says WS reply failures automatically fall back to the Agent API and that multiple channels can be combined, but it does not clearly warn that message data may traverse additional delivery paths and credentials beyond the initially expected channel. In regulated or segmented environments, this can cause unintended data propagation, audit gaps, or policy violations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The document exposes a destructive calendar_delete capability with a direct example but does not instruct the agent to obtain explicit user confirmation, preview the target, or warn that deletion is irreversible and may affect shared organizational calendars. In an agent setting, this omission can lead to accidental or prompt-induced deletion of important calendars without adequate safeguards.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The schedule_delete section documents cancellation of events, including recurring-event modes that can remove a single instance, all future instances, or the entire series, but it does not warn about the operational impact or require confirmation. This is particularly risky in calendar automation because an agent could cancel broad sets of meetings and disrupt participants at scale from an ambiguous or malicious prompt.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The documented automatic cleanup of default fields and records performs silent destructive modification immediately after creation without prominently warning users. In a business document platform, automatic deletion can remove template content or assumptions users expected to keep, increasing the risk of unintended data loss or integrity issues.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill documents a destructive delete action without requiring confirmation, warning about irreversibility, or encouraging pre-deletion verification. In an agent context, ambiguous natural-language requests could cause accidental permanent removal of documents or forms, leading to data loss and business disruption.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
Automatically deleting inherited default fields after adding fields changes user data/schema state in a destructive way without a strong safety warning. In agent-driven workflows, users may not realize a field addition can also remove existing columns, which can break downstream automations, references, or expected sheet structure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Record deletion is exposed without emphasizing irreversible removal or recommending verification of record IDs and scope. In an LLM-agent setting, bulk deletion APIs are especially risky because misunderstood prompts or malformed selection logic can rapidly destroy operational data at scale.
- Content