ClawHub
Back to skill

Security audit

WeChat Draft Publisher

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly does what it says, but it can mutate a WeChat account and includes public-publish and external image-network behavior without strong scoping or confirmation safeguards.

Review carefully before installing. Use it only for content you are comfortable sending to WeChat and any configured image-generation provider, keep API keys in a dedicated low-privilege account if possible, avoid the --publish flag unless you have reviewed the draft, and consider adding explicit confirmation plus allowlisted image providers before production use.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/image_api.py:19
Finding

Unrestricted Credential-Bearing Image API Destination and Response-Driven SSRF

Content
View full analysis
str: """下载图片到本地""" if url.startswith("data:"): # base64 数据直接写入 import base64 b64_data = url.split(",", 1)[1] with open(save_path, "wb") as f: f.write(base64.b64decode(b64_data)) else: resp = requests.get(url, timeout=30) resp.raise_for_status() with open(save_path, "wb") as f: f.write(resp.content) return save_path ``` ```python # scripts/publish.py:47-66 if os.path.isfile(config_path): with open(config_path, "r", encoding="utf-8") as f: config = json.load(f) log(f"已加载配置文件: {config_path}") else: log("未找到 config.json，将使用环境变量") wechat = config.get("wechat", {}) image = config.get("image_api", {}) return { "wechat_appid": wech ...[truncated 3562 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/formatter.py:182
Finding

HTML and Attribute Injection in Markdown Formatting

Content
View full analysis
{text}') continue ``` ```python # scripts/formatter.py:199-202 text = _inline_format(stripped[2:]) html_parts.append( f'
{text}
' ) ``` ```python # scripts/formatter.py:220-225 if not in_list or list_type != "ul": _flush_list(html_parts, list_items, list_type) list_items = [] in_list = True list_type = "ul" list_items.append(_inline_format(ul_match.group(1))) ``` ```python # scripts/formatter.py:270-290 def _inline_format(text: str) -> str: """处理行内 Markdown 格式：粗体、斜体、行内代码、链接""" # 行内代码 text = re.sub( r"`([^`]+)`", rf'\1', text, ) # 粗体 text = re.sub( r"\*\*(.+?)\*\*", rf'\1', text, ) # 斜体 text = re.sub(r"\*(.+?)\*", r"\1", text) # 链接 text = re.sub( r"\[([^\]]+)\]\(([^)]+)\)", r'\1', text, ) return text ``` The same unsafe pattern is used for normal paragraphs: ```python text = _inline_format(stripped) html_parts.append(f'

{text}

') ``` ### Technical Analysis Markdown text is inserted into generated HTML without being HTML-escaped first. The `_escape_html()` helper is applied only to fenced code blocks, not to headings, quotations, list items, paragraphs, link labels, or link destinations. The regular-expression link conversion places the captured destination directly inside a quoted `href` attribute. A crafted destina ...[truncated 1838 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
requirements.txt:1
Finding

Unpinned and Unnecessary Third-Party Dependencies

Content
View full analysis
=2.28.0 Pillow>=9.0.0 ``` ```bash # README.md:24-28 pip3 install -r ~/.openclaw/skills/wechat-article-publisher/requirements.txt ``` ### Technical Analysis Both dependencies use open-ended minimum-version constraints. A future installation can therefore resolve to package versions that were not reviewed with this Skill. No lock file or package hashes are supplied, so installation is neither reproducible nor protected against unexpected artifact substitution. The audited Python code imports `requests`, but it does not import or otherwise use `Pillow`. Installing this unused package unnecessarily increases the dependency graph, installation-time code surface, and number of components that must be monitored for vulnerabilities. The package names are legitimate and no dependency confusion or typosquatting was identified. The risk arises from unsafe version-selection practices and an unnecessary dependency, not from evidence that the currently named packages are malicious. ### Attack Path 1. A user follows the documented installation command. 2. The package resolver selects any available version satisfying the broad `>=` constraints. 3. A future compromised release, malicious artifact from an untrusted package index, or incompatible release may be selected without a source change in this project. 4. Package installation hooks execute with the privileges of the user running `pip`. 5. An affected dependency can compromise the environment or alter runtime behavior before the Skill is invoked. ### Impact Assessment The maximum impact is determined by the privileges used to install the dependencies. If installation is performed as a privileged account, a compromised package could execut ...[truncated 354 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (30)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The mismatch between claimed AI writing/publishing behavior and actual capabilities can conceal what data is processed, what files are required, and what account operations may occur. In a skill that touches WeChat content and external APIs, such ambiguity increases the risk of unintended execution paths and uninformed user consent.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The mismatch between claimed AI writing/publishing behavior and actual capabilities can conceal what data is processed, what files are required, and what account operations may occur. In a skill that touches WeChat content and external APIs, such ambiguity increases the risk of unintended execution paths and uninformed user consent.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The mismatch between claimed AI writing/publishing behavior and actual capabilities can conceal what data is processed, what files are required, and what account operations may occur. In a skill that touches WeChat content and external APIs, such ambiguity increases the risk of unintended execution paths and uninformed user consent.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding

The mismatch between claimed AI writing/publishing behavior and actual capabilities can conceal what data is processed, what files are required, and what account operations may occur. In a skill that touches WeChat content and external APIs, such ambiguity increases the risk of unintended execution paths and uninformed user consent.

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The trigger phrases are so broad that ordinary requests like '写xxx' could invoke an automated workflow that reads configuration, calls external APIs, saves files, and creates WeChat drafts. Overbroad activation is especially dangerous here because the skill performs account-affecting actions, so accidental invocation can lead to unintended content transmission and publication artifacts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The feature summary emphasizes convenience but does not prominently warn that article content, prompts, and images may be transmitted to third-party image APIs and to the WeChat public platform. This can mislead users about data handling and create privacy, confidentiality, and compliance risks if sensitive content is submitted.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README shows very broad trigger examples such as '帮我写...' and '写xxx', which can easily overlap with ordinary writing requests. In an agent environment, this increases the chance of unintended skill activation, causing automatic generation, external API use, and draft creation without the user clearly intending to invoke publishing behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The README lists a '--publish' option that can immediately submit content for publication, but it does not provide a strong warning about the operational impact of posting to a public account. Without explicit caution and confirmation guidance, users may unintentionally publish incorrect, sensitive, or policy-violating content.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill declares access to environment variables and describes reading local configuration plus calling external services, but it does not define an explicit tool scope such as allowed-tools or permissions. This increases the blast radius of a prompt-triggered workflow that can read files and perform network actions, making accidental or overbroad tool use harder to constrain or audit.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The description does not clearly warn users that article content and image prompts may be sent to third-party services and that a draft will be created in their WeChat account. Missing disclosure undermines informed consent and can expose private, regulated, or proprietary content during what appears to be a routine writing request.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The activation logic does not clearly distinguish between standard writing assistance and the auto-publish workflow, which can cause the skill to escalate a normal content request into external processing and WeChat account actions. Ambiguity in trigger boundaries is risky when the workflow includes network transmission and draft creation.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 48)May include surrounding context.

md
},
  "image_api": {
    "api_key": "你的 API Key",
    "api_base_url": "https://api.siliconflow.cn/v1/images/generations",
    "model": "black-forest-labs/FLUX.1-schnell",
    "_help": "支持任何兼容 OpenAI 格式的文生图 API，常见服务商见 README"
  }

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 64)May include surrounding context.

md
},
  "image_api": {
    "api_key": "你的 API Key",
    "api_base_url": "https://api.siliconflow.cn/v1/images/generations",
    "model": "black-forest-labs/FLUX.1-schnell",
    "_help": "支持任何兼容 OpenAI 格式的文生图 API，常见服务商见 README"
  }

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · config_example.json (reported line 9)May include surrounding context.

json
},
  "image_api": {
    "api_key": "你的 API Key",
    "api_base_url": "https://api.siliconflow.cn/v1/images/generations",
    "model": "black-forest-labs/FLUX.1-schnell",
    "_help": "支持任何兼容 OpenAI 格式的文生图 API，常见服务商见 README"
  }

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The module docstrings and user-facing error messages are in Chinese only, which can amount to a language policy violation when no user opt-in or locale justification is provided. There is no indication in this file that the skill is intentionally limited to Chinese-speaking users or a China-specific compliance context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This code posts the user's prompt to an external image-generation API and includes a bearer API key in the request headers. Although network transmission is central to the module's function, the file does not include any user-facing warning, confirmation, or disclosure about sending prompt content to third-party services.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill is described as publishing to the WeChat draft box, but the code includes a --publish flag that can immediately submit the article for publication. This creates a capability/expectation mismatch that can cause users or orchestrators to trigger a more consequential action than intended, especially in an automated agent context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The script uploads generated article images to WeChat, and later sends the full article HTML to WeChat when creating a draft. Although logging indicates the action is happening, there is no explicit user-facing warning that article content and related assets will be transmitted to third-party services, which is relevant for privacy and data-handling awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script can submit a publish task immediately when --publish is present, without any interactive confirmation or secondary approval. In an agent-driven environment, this increases the risk of accidental public release of unreviewed or sensitive content due to prompt ambiguity, automation errors, or misuse.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/wechat_api.py (reported line 15)May include surrounding context.

python
class WeChatAPI:
    """微信公众号 API 客户端"""

    BASE_URL = "https://api.weixin.qq.com/cgi-bin"

    def __init__(self, appid: str = None, appsecret: str = None):
        self.appid = appid or os.environ.get("WECHAT_APPID", "")

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill metadata says it should write and automatically publish only to the WeChat draft box, but this function submits the draft for actual publication via the freepublish endpoint. That creates a scope violation: an agent invoked for draft-saving can trigger public content release, which is materially more sensitive and can cause unauthorized posting, reputational damage, or policy violations if called without explicit user confirmation.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/wechat_api.py (reported line 136)May include surrounding context.

python
url = f"{self.BASE_URL}/freepublish/submit?access_token={token}"

        payload = {"media_id": media_id}
        resp = requests.post(url, json=payload, timeout=15)

        data = resp.json()
        if data.get("errcode", 0) != 0:

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
97% confidence
Finding

The dependency specifier requests>=2.28.0 is unpinned, so builds may resolve to different versions over time, reducing reproducibility and making it harder to ensure only reviewed, non-vulnerable releases are installed. In a publishing skill that likely performs network requests, supply-chain drift can expose the runtime to newly introduced bugs or known vulnerable versions if mirrors or environments resolve unexpectedly.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
requests>=2.28.0
Pillow>=9.0.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
89% confidence
Finding

requests has multiple known advisories, and because the manifest does not pin an exact version, there is no reliable way to verify whether deployments will avoid affected releases. This is especially relevant for a skill that likely communicates with remote services such as AI or WeChat APIs, where HTTP client flaws can affect credential handling, TLS behavior, or request integrity.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
97% confidence
Finding

The dependency specifier Pillow>=9.0.0 is unpinned, which permits uncontrolled version selection and weakens reproducible builds. Because this skill processes images for article illustrations and covers, an unexpected or vulnerable Pillow release could increase exposure to image parsing flaws, denial of service, or worse depending on the resolved version.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text
requests>=2.28.0
Pillow>=9.0.0

Static analysis

No suspicious patterns detected.