bozo-wechat-publisher 安全扫描报告 — 低风险 | ClawSafe

15 /100

bozo-wechat-publisher

一键发布 Markdown 文章到微信公众号草稿箱

Legitimate WeChat publishing skill with documented shell execution for npm packages and credential management. Minor concerns include unpinned npm versions but no malicious indicators found.

技能名称bozo-wechat-publisher

分析耗时33.2s

引擎pi

✓

可以安装

Approve for use. Consider pinning npm package versions for better reproducibility. Ensure TOOLS.md credential file has appropriate file permissions (600).

安全发现 2 项

严重性	安全发现	位置
低危	npm package versions not pinned 供应链 Scripts use 'npm install -g @wenyan-md/cli' without specifying a version. This could lead to unexpected behavior if the package is updated with breaking changes. `npm install -g @wenyan-md/cli` → Consider pinning the version: npm install -g @wenyan-md/[email protected]	`scripts/publish.sh:26`
提示	TOOLS.md credential access pattern 文档欺骗 Scripts read credentials from $HOME/.openclaw/workspace/TOOLS.md using grep/sed. This pattern is documented in SKILL.md and is the expected credential management approach. `WECHAT_APP_ID=$(grep "export WECHAT_APP_ID=" "$TOOLS_MD" \| head -1 \| sed 's/.*export WECHAT_APP_ID=//' \| tr -d ' ')` → Ensure TOOLS.md has restrictive permissions (chmod 600) to prevent unauthorized access to credentials.	`scripts/setup.sh:16`

资源类型	声明权限	推断权限	状态	证据
命令执行	`WRITE`	`WRITE`	✓ 一致	SKILL.md line 47: 'npm install -g @wenyan-md/cli'
网络访问	`READ`	`READ`	✓ 一致	Scripts only connect to api.weixin.qq.com (WeChat official API)
文件系统	`READ`	`READ`	✓ 一致	Scripts read Markdown files and TOOLS.md
环境变量	`READ`	`READ`	✓ 一致	Scripts read WECHAT_APP_ID/SECRET from environment or TOOLS.md

20 项发现

🔗

中危外部 URL 外部 URL

https://mp.weixin.qq.com/

MIGRATION.md:44

🔗

中危外部 URL 外部 URL

https://deb.nodesource.com/setup_18.x

MIGRATION.md:54

🔗

中危外部 URL 外部 URL

https://nodejs.org/dist/v18.20.2/node-v18.20.2-x64.msi

MIGRATION.md:77

🔗

中危外部 URL 外部 URL

https://ifconfig.me/

MIGRATION.md:88

🔗

中危外部 URL 外部 URL

https://via.placeholder.com/1080x864

MIGRATION.md:151

🔗

中危外部 URL 外部 URL

https://registry.npmmirror.com

MIGRATION.md:268

🔗

中危外部 URL 外部 URL

https://developers.weixin.qq.com/doc/offiaccount/

MIGRATION.md:305

🔗

中危外部 URL 外部 URL

https://nodejs.org/dist/v18.20.2/

README.md:78

🔗

中危外部 URL 外部 URL

https://openclaw.ai

README.md:292

🔗

中危外部 URL 外部 URL

https://myblog.com/original-post

SKILL.md:460

🔗

中危外部 URL 外部 URL

https://wenyan.yuzhi.tech

SKILL.md:541

🔗

中危外部 URL 外部 URL

https://www.slas.cc

example.md:6

🔗

中危外部 URL 外部 URL

https://myblog.com/post

example.md:116

🔗

中危外部 URL 外部 URL

https://cdn.example.com/cover.jpg

example.md:190

🔗

中危外部 URL 外部 URL

https://yuzhi.tech/docs/wenyan/upload

references/troubleshooting.md:29

🔗

中危外部 URL 外部 URL

https://api.weixin.qq.com

references/troubleshooting.md:246

🔗

中危外部 URL 外部 URL

https://api.weixin.qq.com/cgi-bin/token

scripts/publish-card-theme-v2.sh:26

🔗

中危外部 URL 外部 URL

https://api.weixin.qq.com/cgi-bin/stable_token

scripts/publish-card-theme-v2.sh:27

🔗

中危外部 URL 外部 URL

https://api.weixin.qq.com/cgi-bin/material/add_material

scripts/publish-card-theme-v2.sh:28

🔗

中危外部 URL 外部 URL

https://api.weixin.qq.com/cgi-bin/draft/add

scripts/publish-card-theme-v2.sh:29

目录结构

18 文件 · 113.1 KB · 4539 行

Markdown 7f · 2152L Shell 7f · 1565L HTML 2f · 719L JSON 2f · 103L

├─ ▾ 📁 references

│ ├─ 📝 themes.md Markdown 119L · 2.3 KB

│ └─ 📝 troubleshooting.md Markdown 329L · 5.8 KB

├─ ▾ 📁 scripts

│ ├─ 🔧 debug-publish.sh Shell 83L · 2.4 KB

│ ├─ 🔧 publish-card-theme-v2.sh Shell 316L · 9.8 KB

│ ├─ 🔧 publish-card-theme.sh Shell 400L · 12.0 KB

│ ├─ 🔧 publish-curl.sh Shell 317L · 9.5 KB

│ ├─ 🔧 publish.sh Shell 148L · 4.2 KB

│ ├─ 🔧 setup.sh Shell 44L · 1.4 KB

│ └─ 🔧 use-theme.sh Shell 257L · 7.4 KB

├─ ▾ 📁 themes

│ ├─ 📄 card-neon-light.html HTML 356L · 9.3 KB

│ ├─ 📄 card-tech-dark.html HTML 363L · 9.3 KB

│ └─ 📋 theme-config.json JSON 98L · 2.9 KB

├─ 📋 _meta.json JSON 5L · 135 B

├─ 📝 example.md Markdown 301L · 6.0 KB

├─ 📝 MIGRATION.md Markdown 309L · 6.3 KB

├─ 📝 README.md Markdown 296L · 6.2 KB

├─ 📝 SKILL.md Markdown 545L · 12.4 KB

└─ 📝 THEME_GUIDE.md Markdown 253L · 5.7 KB

依赖分析 1 项

包名	版本	来源	已知漏洞	备注
`@wenyan-md/cli`	`*`	npm	否	Version not pinned, installed globally

安全亮点

✓ All network requests go to official WeChat API (api.weixin.qq.com)

✓ No base64-encoded execution or obfuscation detected

✓ No credential exfiltration - credentials used only for WeChat API authentication

✓ No access to sensitive paths like ~/.ssh, ~/.aws, or .env files

✓ No reverse shell, C2 communication, or data theft patterns

✓ Documentation accurately describes functionality

✓ Shell commands are necessary for the legitimate purpose (npm package installation)