ClawHub
Back to skill

Security audit

Wechat Publish

Security checks for vulnerabilities and agentic risk

Overview

This skill matches its WeChat publishing purpose, but it asks users to handle account credentials and can upload or publish content without enough safety guidance.

Install only if you intend this agent to help operate a WeChat public-account publishing workflow. Use test or least-privilege credentials, avoid pasting real secrets into shell commands, review all generated images and article HTML before upload, and require a separate human approval before any API publication step.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:145
Finding

WeChat Credentials Exposed in Command-Line URL Parameters

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (12)

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

方式A：MakeContents封面图（固定接口）

适合：封面/缩略图

bash
curl -s -X POST "http://localhost:3710/api/content/render" \
  -H "Content-Type: application/json" \
  -d '{"cover_word":"标签","cover_title":"标题","cover_description":"描述","cover_emoji":"🤖"}'

Credential Access

High
Category
Privilege Escalation
Confidence
97% confidence
Finding

The skill explicitly instructs acquisition and use of an access token derived from AppID and secret, but it does not provide secure handling practices for these credentials. In command-line workflows, secrets and tokens are commonly exposed through shell history, process listings, pasted transcripts, or logs, making this a genuine credential-safety issue.

Content

Scanner excerpt · SKILL.md (reported line 144)May include surrounding context.

凭证

bash
# 获取Access Token
curl -s -X POST "https://api.weixin.qq.com/cgi-bin/token?grant_type=client_credential&appid=YOUR_APPID&secret=YOUR_SECRET"

返回值中的access_token有效期2小时

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

方式A：MakeContents封面图（固定接口）

适合：封面/缩略图

bash
curl -s -X POST "http://localhost:3710/api/content/render" \
  -H "Content-Type: application/json" \
  -d '{"cover_word":"标签","cover_title":"标题","cover_description":"描述","cover_emoji":"🤖"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.

2. 转图片（width=750适合手机，height按需调整）

HTML=$(cat /tmp/custom_image.html | python3 -c "import sys,json; print(json.dumps(sys.stdin.read()))") curl -s -X POST "http://localhost:3710/api/content/render-text"
-H "Content-Type: application/json"
-d "{"html":$HTML,"width":750,"height":1200}"

text

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill instructs users to obtain and use WeChat API credentials and then transmit generated content and media to a third-party platform, but it does not include explicit safety guidance about secret handling, authorization, or data-sharing implications. This creates a real risk of accidental credential exposure and unintended exfiltration of user content to external services.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The skill directs content and credentials to the WeChat API, which is an external service boundary and therefore a real data-transmission risk. In context this is expected behavior, but it still needs explicit disclosure and consent because user content and authentication material leave the local environment.

Content

Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.

凭证

bash
# 获取Access Token
curl -s -X POST "https://api.weixin.qq.com/cgi-bin/token?grant_type=client_credential&appid=YOUR_APPID&secret=YOUR_SECRET"

返回值中的access_token有效期2小时

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The skill directs content and credentials to the WeChat API, which is an external service boundary and therefore a real data-transmission risk. In context this is expected behavior, but it still needs explicit disclosure and consent because user content and authentication material leave the local environment.

Content

Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.

凭证

bash
# 获取Access Token
curl -s -X POST "https://api.weixin.qq.com/cgi-bin/token?grant_type=client_credential&appid=YOUR_APPID&secret=YOUR_SECRET"

返回值中的access_token有效期2小时

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

This step uploads local image files to WeChat's permanent media store using an access token, which is a real outbound data transfer to a third party. The risk is not maliciousness but that unpublished or sensitive images could be sent externally without adequate user awareness or controls.

Content

Scanner excerpt · SKILL.md (reported line 154)May include surrounding context.

md
ACCESS_TOKEN="获取到的token"

# 封面图
curl -s -X POST "https://api.weixin.qq.com/cgi-bin/material/add_material?access_token=$ACCESS_TOKEN&type=image" \
  -F "media=@/tmp/cover.png"

# 详情图

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

This second media-upload endpoint sends detail images to WeChat, again crossing a trust boundary and publishing content to an external platform. If the images contain confidential information, the skill provides no guardrails to prevent accidental disclosure.

Content

Scanner excerpt · SKILL.md (reported line 158)May include surrounding context.

-F "media=@/tmp/cover.png"

详情图

curl -s -X POST "https://api.weixin.qq.com/cgi-bin/material/add_material?access_token=$ACCESS_TOKEN&type=image"
-F "media=@/tmp/detail.png"

text

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

Uploading a thumbnail to WeChat is another external transfer of local content governed by the same risks as the full-image uploads. Because the skill automates the workflow, users may not notice that media is being persisted on a third-party platform.

Content

Scanner excerpt · SKILL.md (reported line 166)May include surrounding context.

上传缩略图（用于文章thumb_media_id）

bash
curl -s -X POST "https://api.weixin.qq.com/cgi-bin/material/add_material?access_token=$ACCESS_TOKEN&type=thumb" \
  -F "media=@/tmp/cover.png"

返回的media_id用于文章配置的thumb_media_id字段

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

Creating a draft sends the full article HTML and referenced image URLs to WeChat, which is a clear external transmission of potentially sensitive content. The danger is increased by the workflow's one-click framing, which can normalize sending unpublished material off-system without adequate review.

Content

Scanner excerpt · SKILL.md (reported line 192)May include surrounding context.

} EOF

curl -s -X POST "https://api.weixin.qq.com/cgi-bin/draft/add?access_token=$ACCESS_TOKEN"
-H "Content-Type: application/json"
-d @/tmp/article.json

text

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

This step submits a draft for publication via WeChat, turning prior content transmission into an externally visible publishing action. The security impact is higher because misuse or accidental execution could cause unauthorized public release of content, reputational damage, or compliance issues.

Content

Scanner excerpt · SKILL.md (reported line 203)May include surrounding context.

API发布（服务号可用）

bash
curl -s -X POST "https://api.weixin.qq.com/cgi-bin/freepublish/submit?access_token=$ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"media_id":"草稿media_id","pub_choose_type":1}'

Static analysis

No suspicious patterns detected.