channel
4 findings (1 critical, 2 high, 1 medium), mainly data exfiltration, command injection, resource abuse. Most recent scan 2026-02-07.
This WeChat Official Account management skill presents CRITICAL and HIGH security risks primarily related to credential management and data exfiltration potential. The skill requires users to store API credentials in plaintext environment variables and makes unrestricted network requests to external APIs. While the core functionality (managing WeChat drafts) is legitimate, the implementation has significant security gaps: hardcoded credential storage patterns, lack of input validation on file paths (command injection risk), unrestricted network access without user confirmation, and missing security controls on cache files. The skill would benefit from implementing secure credential storage, input validation, explicit user consent for network operations, and proper error handling. The missing 'allowed-tools' declaration and license information are lower-priority concerns but should be addressed for transparency.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
WeChat Official Account Draft Box management tool. Create and manage graphic draft articles via WeChat API, supporting text and images. Automatically extracts the first paragraph as summary. Supports draft creation, listing, publishing, and deletion.
- Package
- 3 files, 32 KB
- SKILL.md
- 630 words, 12+ sections
- Code
- Python (1)
SKILL.md covers: 微信公众号草稿箱管理 · 功能特性 · 前提条件 · 1. 微信公众号认证 · 2. 获取开发者凭证 · 3. 配置环境变量 · 添加到 ~/.zshrc · 使用方法 · 创建草稿 · 正文格式 · 查看草稿列表 · 列出最近 20 篇
Findings
CRITICAL Hardcoded API Credentials Exposure Risk Data Exfiltrationllm
The skill requires users to store WeChat API credentials (WECHAT_APPID and WECHAT_APPSECRET) as environment variables. While environment variables are better than hardcoding, the instructions explicitly guide users to add these sensitive credentials to ~/.zshrc, which persists them in plaintext in shell configuration files. This creates a credential exposure risk if the shell config is accidentally committed to version control, shared, or accessed by malicious scripts. The skill also caches access tokens in ~/.config/channel/access_token.json without encryption.
SKILL.md
```bash
# 添加到 ~/.zshrc
export WECHAT_APPID="your-app-id"
export WECHAT_APPSECRET="your-app-secret"
```HIGH Command Injection via Unvalidated File Paths Command Injectionllm
The script accepts file paths from command-line arguments (--file, --cover) and directly opens them without proper validation or sanitization. An attacker could potentially inject malicious file paths or use path traversal techniques to read arbitrary files from the system. The script uses os.path.expanduser() which could be exploited with crafted input.
scripts/channel.py
File path handling in upload_image() and create_draft() functions accepts user input without validation: `with open(image_path, 'rb') as f:` and `with open(args.file, 'r', encoding='utf-8') as f:`HIGH Unrestricted Network Access to External API Data Exfiltrationllm
The skill makes unrestricted HTTPS requests to WeChat API endpoints (api.weixin.qq.com) without any network access controls or user confirmation. While this is necessary for the skill's functionality, it creates a data exfiltration channel. The skill sends user-provided content (article titles, content, images) to external servers without explicit user consent for each transmission. If credentials are compromised, an attacker could exfiltrate arbitrary data through the WeChat API.
scripts/channel.py
Multiple urllib.request.urlopen() calls to external API: `urllib.request.urlopen(req)` sending user data to https://api.weixin.qq.com without confirmationMEDIUM Potential Resource Exhaustion via Unbounded File Operations Resource Abusellm
The script reads entire files into memory without size limits when processing content files (--file) and images (--cover). Large files could cause memory exhaustion. The list command also has a configurable limit but no maximum cap, potentially allowing retrieval of thousands of drafts in a single operation.
scripts/channel.py
Unbounded file reads: `content = f.read()` without size checks, `image_data = f.read()` without size validation, list command accepts arbitrary --limit valuesWhat is in the package
| File | Kind | Size |
|---|---|---|
SKILL.md | doc | 7.4 KB |
references/wechat_api.md | doc | 7.3 KB |
scripts/channel.py | script | 17 KB |
External hosts referenced
api.weixin.qq.com developers.weixin.qq.com mp.weixin.qq.com mmbiz.qpic.cn
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Environment variables referenced
MEDIA_ID WECHAT_APPSECRET
Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://clawhub.ai/skills/channel
- Raw scan result: wechat-oa-channel-scan.json
- Badge for your README:
- Request a re-scan