ClawHub
Back to skill

Security audit

Wechat AutoPublish

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its WeChat draft-publishing purpose, but it needs review because it handles account secrets and local media with weak endpoint validation and token-cache protections.

Install only after reviewing and controlling config.json. Keep apiBaseUrl fixed to https://api.weixin.qq.com, protect config.json and .tokens with owner-only permissions, avoid running scheduled workflows without review, and check which local images will be uploaded before creating drafts.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/publish_article.py:80
Finding

Configurable API origin can disclose WeChat credentials and publishing data

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/publish_article.js:102
Finding

Node.js client trusts a configurable destination for secrets, tokens, and publishing data

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/publish_article.py:103
Finding

Python access-token cache is written without restrictive permissions or account isolation

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/publish_article.js:115
Finding

Node.js access-token cache relies on ambient filesystem permissions

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:27
Finding

Installation instructions use unpinned third-party dependencies without integrity verification

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (18)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md
## 功能

- 自动获取和缓存 Access Token
- 创建图文草稿到微信公众号
- 上传封面图片到素材库
- **自动上传正文图片并替换 URL**

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 327)May include surrounding context.

md
## 功能

- 自动获取和缓存 Access Token
- 创建图文草稿到微信公众号
- 上传封面图片到素材库
- **自动上传正文图片并替换 URL**

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/README.md (reported line 7)May include surrounding context.

md
## 功能

- 自动获取和缓存 Access Token
- 创建图文草稿到微信公众号
- 上传封面图片到素材库
- **自动上传正文图片并替换 URL**

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/README.md (reported line 379)May include surrounding context.

md
## 功能

- 自动获取和缓存 Access Token
- 创建图文草稿到微信公众号
- 上传封面图片到素材库
- **自动上传正文图片并替换 URL**

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/README.md (reported line 521)May include surrounding context.

md
## 功能

- 自动获取和缓存 Access Token
- 创建图文草稿到微信公众号
- 上传封面图片到素材库
- **自动上传正文图片并替换 URL**

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/publish_article.js (reported line 123)May include surrounding context.

js
## 功能

- 自动获取和缓存 Access Token
- 创建图文草稿到微信公众号
- 上传封面图片到素材库
- **自动上传正文图片并替换 URL**

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/publish_article.py (reported line 67)May include surrounding context.

python
## 功能

- 自动获取和缓存 Access Token
- 创建图文草稿到微信公众号
- 上传封面图片到素材库
- **自动上传正文图片并替换 URL**

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/publish_article.py (reported line 103)May include surrounding context.

python
## 功能

- 自动获取和缓存 Access Token
- 创建图文草稿到微信公众号
- 上传封面图片到素材库
- **自动上传正文图片并替换 URL**

Credential Access

High
Category
Privilege Escalation
Confidence
92% confidence
Finding

The script writes the access token to a local JSON cache file without setting restrictive file permissions or using OS-backed secret storage. If the working directory is shared, backed up, committed accidentally, or readable by other local users/processes, the token could be stolen and used to access or act on the associated WeChat account until expiry.

Content

Scanner excerpt · scripts/publish_article.js (reported line 136)May include surrounding context.

js
expires_at: this.tokenExpiry
    }, null, 2));

    console.log(`✅ Access Token 获取成功`);
    return this.accessToken;
  }

Credential Access

High
Category
Privilege Escalation
Confidence
84% confidence
Finding

The script persists the WeChat access token in plaintext to a local cache file without enforcing restrictive permissions or secure storage. If the host is multi-user, the working directory is shared, or filesystem access is compromised, another local process or user could reuse the token to act against the associated WeChat account until expiry.

Content

Scanner excerpt · scripts/publish_article.py (reported line 116)May include surrounding context.

python
'expires_at': self.token_expiry
            }, f)

        print(f"✅ Access Token 获取成功")
        return self.access_token

    async def upload_image(self, image_path: str, is_thumb: bool = False) -> dict:

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill describes capabilities that read local files, write token caches/config-related data, and make network calls, but it does not declare any explicit tool scope or allowed-tools boundary. In an agent environment this increases the chance of over-broad execution, unintended file access, or invocation with more privileges than the skill actually needs.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger language is broad enough that an agent may activate the skill on loosely related publishing or content-formatting requests without clear user intent to publish. Because this skill can create drafts and drive external publication workflows, accidental invocation could expose credentials, upload private images, or create unwanted content in a public channel.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The example requests expand the activation surface to common phrases about publishing, scheduling, formatting, and image handling, but they do not define boundaries for when the skill must not run. In practice, that can cause the agent to treat ordinary content-editing requests as authorization to upload files or prepare publication artifacts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill promotes scheduled and automated publication workflows but does not prominently require a human approval gate before content affecting the公众号 is created or published. Automation against a public-facing account amplifies mistakes: a misfire, poisoned prompt, or bad upstream content source could lead to unauthorized or reputationally damaging posts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The README documents automatic upload of local images embedded in article HTML to WeChat, but the workflow does not prominently warn users that local files will be transmitted to a third-party service. This creates a real privacy and data-handling risk because authors may unintentionally upload sensitive local images when processing HTML content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script's user-facing description and all CLI/output strings are in Chinese, which effectively imposes a specific language on users. There is no opt-in, language selection mechanism, or documented justification that this skill is intended only for a Chinese-only audience or region-specific compliance context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The file’s natural-language interface and description are entirely in Chinese, starting with the module docstring "发布文章到微信公众号", and the CLI help/output strings throughout the script are also Chinese-only. Under the policy rule, this is a language/locale constraint presented without user opt-in or an explicit justification that the skill is limited to a Chinese-language audience.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The example configuration uses a Chinese account name string ("我的公众号") as the default visible value, which implies a specific language/locale preference. The file does not indicate that language is configurable by user choice or that the locale is intentionally region-specific, so it may conflict with a policy requiring language neutrality or opt-in.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/publish_article.js:101