WeChat File Sender

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:14 AM UTC
• Version: 1.0.1

Overview

This skill is meant to send a chosen file through WeChat, but it relies on fragile UI automation and makes misleading security claims about data transfer.

Review carefully before installing or using. Only use this with non-sensitive files and contacts where misdelivery would be acceptable, and prefer an implementation that verifies the exact WeChat conversation and asks for confirmation before sending. The packaged skill also appears incomplete because the referenced PowerShell file is absent.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:104

Finding

Unverified Recipient Selection May Disclose Files to the Wrong Contact

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 104-108 and 128-132
Vulnerability Type: Unverified UI target selection and unsafe automatic transmission
Risk Level: Medium

Vulnerable Code

powershell

# Step 4: Select first result and enter chat
[System.Windows.Forms.SendKeys]::SendWait("{UP}")
Start-Sleep 0.5
[System.Windows.Forms.SendKeys]::SendWait("{ENTER}")
Start-Sleep 1

powershell

# Step 6: Paste and send
[System.Windows.Forms.SendKeys]::SendWait("^v")
Start-Sleep 1
[System.Windows.Forms.SendKeys]::SendWait("{ENTER}")
Write-Host "[OK] File sent to: $contactName"

Technical Analysis

The documented PowerShell automation selects the first WeChat search result using keyboard events but never reads the selected result or verifies that its identity exactly matches contactName. It subsequently pastes and sends the file with another unconditional keyboard event.

Reliance on global SendKeys events and fixed delays also creates focus and timing races. Search-result ordering, similar contact names, UI latency, unexpected dialogs, or focus changes can cause the operations to target a different conversation or control. The success message is based on the supplied contact name rather than verification of the active conversation or actual recipient.

The PowerShell code is embedded in SKILL.md; the referenced scripts/send-file.ps1 file is absent from the audited package. Therefore, the current JavaScript entry point fails its existence check before this behavior can execute. The vulnerability applies if the documented script is materialized or otherwise used as instructed.

Attack Path

1. A user invokes the skill with an existing absolute file path and an intended contact name.
2. WeChat returns multiple or similarly named contacts, or another contact appears first in the result ordering.
3. The automation presses Up and Enter without determining which result i ...[truncated 764 chars]

Remediation

View remediation

Remediation Suggestions

• Replace global keyboard navigation with Windows UI Automation queries that identify search results and conversation headers through stable automation properties.
• Normalize and compare the selected result's complete display name against contactName; reject partial, ambiguous, or duplicate matches.
• Verify the active conversation header immediately before pasting and again before sending.
• Require explicit user confirmation that displays both the resolved recipient and canonical file path before transmission.
• Fail closed if focus cannot be confirmed, multiple matches exist, UI elements are unavailable, or any operation times out.
• Check the return value of focus-related Win32 operations and confirm that the WeChat window remains foreground.
• Avoid fixed sleeps as the sole synchronization mechanism; wait for specific UI state transitions with bounded timeouts.
• Report success only after obtaining evidence from the UI that the intended conversation received the file.
• Include the reviewed PowerShell file in the package so the executable implementation matches the documented and audited source.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill claims that filePath must be absolute and contactName is tightly validated, but the embedded PowerShell performs neither check. This mismatch is dangerous because downstream users or orchestrators may rely on the stated constraints and pass attacker-controlled values into UI automation that manipulates the clipboard and sends files to arbitrary recipients.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 118)May include surrounding context.

md

$fc.Add((Resolve-Path $filePath))
[System.Windows.Forms.Clipboard]::Clear()
Start-Sleep 0.5
[System.Windows.Forms.Clipboard]::SetFileDropList($fc)
Start-Sleep 1

[WinAPI]::ShowWindow($hwnd, [WinAPI]::SW_RESTORE)

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The comment is misleading because the script explicitly automates sending a local file to a WeChat contact, which results in external data transmission through the WeChat client even if the script itself does not open a raw network socket. This kind of inaccurate security claim can cause reviewers or operators to underestimate exfiltration risk and approve or use the skill in higher-trust contexts than is appropriate.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/send-file-to-wechat.js:58