ClawHub
Back to skill

Security audit

祝福

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent, but it can send immediate or scheduled WeChat messages through a bearer-token gateway and does not constrain that gateway endpoint to trusted HTTPS hosts.

Review this before installing if the token can send real WeChat messages. Use only a trusted HTTPS operations endpoint, ensure the token is narrowly scoped and revocable, confirm recipient lists and schedules carefully, and avoid enabling this in environments where untrusted users can alter WX_OPENCLAW_OPS_URL or WX_OPENCLAW_OPS_TOKEN.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/send_blessing.py:58
Finding

Configurable Operations Endpoint Can Expose Bearer Tokens and Private Message Data

Content
View full analysis

Vulnerability Details

File Location: scripts/send_blessing.py, lines 58–77
Vulnerability Type: Unrestricted destination and missing HTTPS enforcement for sensitive outbound requests
Risk Level: Medium

Vulnerable Code

python
def post_operation(operation_type: str, payload: dict[str, Any], code: str, timeout: float) -> Any:
    url = os.getenv("WX_OPENCLAW_OPS_URL", "").strip()
    token = os.getenv("WX_OPENCLAW_OPS_TOKEN", "").strip()
    if not url or not token:
        raise UsageError("WX_OPENCLAW_OPS_URL and WX_OPENCLAW_OPS_TOKEN are required for execution")
    request_id = f"skill-{uuid.uuid4().hex}"
    request = urllib.request.Request(
        url,
        data=json.dumps(
            {
                "version": "1.0",
                "requestId": request_id,
                "operationType": operation_type,
                "channel": "OPENCLAW",
                "payload": payload,
            },
            ensure_ascii=False,
        ).encode("utf-8"),
        method="POST",
        headers={
            "Authorization": f"Bearer {token}",
            "Content-Type": "application/json; charset=utf-8",
            "X-Confirmation-Code": code,
            "User-Agent": "wechat-blessings/1.0",
        },
    )

Technical Analysis

The operations endpoint is read directly from WX_OPENCLAW_OPS_URL and used without validating its scheme, hostname, port, or origin. The request includes the bearer token in the Authorization header and embeds recipient identifiers, blessing text, scheduling information, and operation metadata in its body.

Consequently, an incorrectly configured or attacker-influenced environment can direct the request to an untrusted server. The absence of HTTPS enforcement also permits an http:// endpoint, exposing credentials and message data to network interception or modification.

User confirmation does not mitigate this issue be ...[truncated 1573 chars]

Remediation
View remediation

Remediation Suggestions

  1. Parse the configured endpoint with urllib.parse.urlsplit and require the https scheme.
  2. Compare the normalized hostname against a strict allowlist of approved operations-gateway hosts.
  3. Reject embedded user information, URL fragments, unexpected ports, malformed hostnames, and non-HTTPS endpoints.
  4. Prevent redirects to a different origin, or validate the scheme and destination again for every redirect before forwarding the authorization header.
  5. Prefer a gateway origin stored in trusted deployment configuration rather than an environment value modifiable by lower-trust processes.
  6. Use short-lived, narrowly scoped tokens limited to the required messaging operations.
  7. Add automated tests confirming rejection of HTTP URLs, attacker-controlled hosts, embedded credentials, unexpected ports, and cross-origin redirects.
  8. Avoid including sensitive server response bodies in error output unless they are explicitly redacted.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

Tainted flow: 'request' from os.getenv (line 67, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/send_blessing.py (reported line 88)May include surrounding context.

python
},
    )
    try:
        with urllib.request.urlopen(request, timeout=timeout) as response:
            raw = response.read().decode("utf-8")
    except urllib.error.HTTPError as exc:
        detail = exc.read().decode("utf-8", "replace")[:2000]

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding

The skill description emphasizes composing blessings and sending only after explicit confirmation, but the actual behavior depends on a private token-authenticated gateway and supports delivery semantics not fully disclosed in the description. This mismatch can mislead users and reviewers about what the skill can do, causing unauthorized or higher-risk messaging workflows to be approved under an incomplete understanding of its reach.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding

The skill requires environment-backed networked operations through a private WeChat gateway, but it does not declare an explicit tool/permission scope limiting those capabilities. That makes the operational boundary unclear to reviewers and enforcement layers, increasing the chance that message delivery or token-backed outbound actions occur with broader access than users expect.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The style guide states that scheduled blessings use the Windows service time zone, currently Asia/Shanghai by default, without requiring the user to confirm or override that setting. In a messaging workflow, this can cause blessings to be delivered at unintended local times, which may create privacy, trust, or operational issues, especially for recipients in other regions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.