ClawHub
Back to skill

Security audit

微信指定联系人自动发送

Security checks for vulnerabilities and agentic risk

Overview

This skill is a real WeChat message sender, but its automatic desktop control can send or paste messages without strong confirmation if the wrong window or contact is active.

Install only if you are comfortable with an agent controlling your desktop, clipboard, and WeChat account to send real messages. Use it with explicit commands, verify the recipient and exact message yourself, avoid sensitive content, test first with File Transfer Assistant, and do not enable batch or scheduled sends without additional confirmation, rate limits, and cancellation controls.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
wechat_auto_send.py:43
Finding

Message Automation Continues After WeChat Window Activation Failure

Content
View full analysis

Vulnerability Details

File Location: wechat_auto_send.py, lines 43-48; execution continues at lines 145-151
Vulnerability Type: Fail-open error handling for security-sensitive desktop automation
Risk Level: Medium

Vulnerable Code

python
except Exception as e:
    print(f"[Warning] Window activation failed: {e}")
    return True

The returned value is treated as successful window activation:

python
if not focus_wechat():
    return 1

success = send_to_contact(args.contact, args.message, args.wait)

Technical Analysis

focus_wechat() returns True when window discovery or activation raises an exception. The caller therefore proceeds with global keyboard shortcuts despite having no assurance that WeChat is the active application.

send_to_contact() subsequently writes the contact and message to the system clipboard and issues global Ctrl+F, Ctrl+V, and Enter keystrokes. Because these events are sent to whichever application currently owns focus, an activation failure can paste the intended recipient and message into another application, trigger unintended actions, or disclose message content.

The script also reports success after completing the keystroke sequence without verifying the active process, selected contact, or actual delivery result.

Attack Path

  1. The user or an agent invokes the skill with a contact and message.
  2. WeChat window activation fails because of an operating-system restriction, stale window handle, focus-stealing prevention, desktop state change, or deliberately induced window-management error.
  3. The exception handler returns True instead of failing closed.
  4. Another application remains focused.
  5. The script copies the recipient and message into the shared clipboard and sends global keyboard shortcuts.
  6. The focused application receives the pasted values and Enter keystrokes, potentially submitting the message or activating an ...[truncated 601 chars]
Remediation
View remediation

Remediation Suggestions

  1. Fail closed on every window-discovery or activation exception by returning False.
  2. Verify that the active window belongs to the expected WeChat process after activation, rather than relying only on a window title.
  3. Abort before modifying the clipboard or issuing keyboard events if focus verification fails.
  4. Verify the selected contact before pasting or sending the message.
  5. Require explicit user confirmation immediately before the final Enter keystroke for sensitive or externally directed messages.
  6. Preserve and restore the user's previous clipboard content in a finally block.
  7. Report success only after obtaining reliable confirmation that the expected conversation was selected and the message was submitted.
  8. Add automated tests proving that activation exceptions stop execution and that send_to_contact() is never called after such failures.

T08 · Insecure Dependencies

Warning
Location
requirements.txt:3
Finding

Dependencies Are Not Reproducibly Pinned or Integrity Verified

Content
View full analysis

Vulnerability Details

File Location: requirements.txt, lines 3-5
Vulnerability Type: Unpinned third-party dependencies without integrity hashes
Risk Level: Medium

Vulnerable Code

text
pyautogui>=0.9.53
pygetwindow>=0.0.9
pyperclip>=1.8.2

Technical Analysis

The dependency declarations specify only minimum versions. Consequently, installation can resolve to any current or future compatible release from the configured package index. The file also contains no cryptographic hashes that bind installation to reviewed artifacts.

These dependencies are particularly sensitive because they are imported by the primary script and can interact with the desktop, windows, keyboard, mouse, and system clipboard. Python packages may also execute code during installation or import. If a package publisher account, package-index response, configured mirror, or future dependency release is compromised, a later installation could execute code that was not included in the audited project.

The package names observed are established package names; the audit found no evidence that the currently declared packages are malicious. The weakness is the absence of version and artifact integrity controls.

Attack Path

  1. An attacker compromises a permitted package release channel, publisher account, or package mirror, or causes an unsafe future release to be selected.
  2. A malicious version is published with a version satisfying the minimum constraint.
  3. A user follows the documented installation procedure.
  4. The resolver downloads the malicious or compromised artifact because it satisfies the open-ended requirement.
  5. Package-controlled code runs during installation or when the application imports the dependency.
  6. The code executes with the privileges of the user installing or running the skill.

Impact Assessment

A compromised dependency could execute arbitrary code with the invoking user's permissio ...[truncated 440 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin every direct dependency to an exact, reviewed version using ==.
  2. Generate a lock file that includes all transitive dependencies.
  3. Require cryptographic hashes during installation, such as a hash-locked requirements file used with pip install --require-hashes.
  4. Install only from an explicitly approved HTTPS package index or controlled internal mirror.
  5. Review dependency release notes and artifacts before updating the lock file.
  6. Run dependency vulnerability and provenance checks in continuous integration.
  7. Test upgrades in an isolated environment before deployment.
  8. Document a controlled dependency-update process instead of recommending unconstrained package installation commands.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (15)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The trigger example "告诉李四资料已准备好" is overly broad because it resembles ordinary conversational language and could cause the agent to invoke the WeChat automation skill when the user may only be drafting or discussing a message. In this skill’s context, unintended invocation is especially risky because execution leads to external side effects: automated outbound messaging through a real account.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The skill documents scheduled and batch outbound messaging without strong guardrails or warnings about abuse, spam, misdelivery, and account enforcement risks. In this context, automation of repeated external communications increases the blast radius of mistakes or misuse, enabling large-scale unintended or unauthorized messaging from the user’s WeChat account.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README describes integration via natural-language commands that trigger real WeChat message sending, but it does not prominently warn that execution causes immediate outbound communication to an actual contact. In an agent context, this increases the risk of accidental messages, misdelivery to the wrong recipient, or unintended disclosure of sensitive information through UI automation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script automates GUI interaction to send arbitrary user-provided text to a selected WeChat contact, but its user-facing prompts focus mainly on window state and countdown timing rather than clearly warning that real messages will be transmitted to another person. In a messaging automation context, insufficient disclosure increases the risk of accidental disclosure, misdirected communication, or unintended transmission if the wrong window/contact is focused.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill is described as applicable whenever a user needs to send a WeChat message, with broad natural-language examples and no clear gating or confirmation requirements. That makes accidental invocation more likely from ordinary conversation, which is dangerous because the skill performs an external side effect by sending real messages to contacts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This skill automates message sending through GUI control of WeChat, but the description does not warn that it can transmit messages to real recipients, cause privacy leaks, or send unintended content if parsing or UI targeting is wrong. Because the action has irreversible external impact, lack of strong user warning and confirmation materially increases the chance of harmful or unauthorized communication.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The trigger phrases are very broad and map closely to ordinary conversational requests like '告诉李四…' or '给[某人]发消息', which increases the chance the agent invokes this skill when the user intended only drafting or discussing a message. Because the skill performs real-world UI automation that sends outbound WeChat messages, an accidental invocation can cause unintended message transmission, privacy leakage, or social/operational harm.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The description notes technical operating constraints but does not clearly warn that the skill can transmit private or sensitive information to real contacts through an external messaging platform. In this context, missing privacy and transmission warnings makes misuse or accidental disclosure more likely, especially since the skill automates user-facing communications rather than only local processing.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

All user-facing instructions and invocation examples are presented exclusively in Chinese, including the natural-language trigger examples, with no indication that other languages are supported or that Chinese is a deliberate locale-specific constraint. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The natural-language description explicitly frames the skill as a WeChat auto-sending tool in Chinese and the implementation also hard-codes Chinese window matching later, indicating a fixed locale assumption. There is no accompanying user opt-in or documented justification that this skill is intended only for a Chinese-language WeChat environment.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
93% confidence
Finding

The dependency is specified with a minimum version only, which allows installation of any newer release, including unexpected breaking or compromised versions. In an automation skill that can control the GUI and clipboard, a malicious or vulnerable upstream package could increase risk through supply-chain compromise.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text
# 微信自动发送消息技能依赖

pyautogui>=0.9.53
pygetwindow>=0.0.9
pyperclip>=1.8.2

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
93% confidence
Finding

Using an unpinned lower-bound dependency permits arbitrary newer versions to be installed, reducing reproducibility and exposing the project to supply-chain risk if a future release is malicious or insecure. Because this skill appears to automate desktop interactions, compromise of supporting packages could affect user input, windows, or data handling.

Content

Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.

text
# 微信自动发送消息技能依赖

pyautogui>=0.9.53
pygetwindow>=0.0.9
pyperclip>=1.8.2

# 可选：用于更稳定的窗口管理

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
93% confidence
Finding

A minimum-version-only requirement allows pip to resolve to later unreviewed releases, creating avoidable supply-chain exposure. In this skill, clipboard-related functionality makes dependency trust more sensitive because a compromised package could access or manipulate copied data.

Content

Scanner excerpt · requirements.txt (reported line 5)May include surrounding context.

text
pyautogui>=0.9.53
pygetwindow>=0.0.9
pyperclip>=1.8.2

# 可选：用于更稳定的窗口管理
# pywin32>=300

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

This Python file contains user-facing natural-language strings entirely in Chinese, including the module description and runtime output. The file does not indicate that the skill is region-specific or offer any language choice, which can violate a language/locale policy requiring user opt-in or explicit justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The console banner, status messages, and usage instructions shown to users are all hard-coded in Chinese. Because the file provides no alternative language option and no statement that the skill is limited to a Chinese-language context, this is a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.