T09 · Insecure Skill Coding Practices
Error
- Location
server.py:312- Finding
Message Transmission Bypasses the Documented Confirmation Gate
- Content
View full analysis
- Remediation
View remediation
Security audit
wechat-skill
Security checks for vulnerabilities and agentic risk
Overview
The skill is a real WeChat automation tool, but it can send messages from the active chat without enforced confirmation and leaves sensitive screenshots on disk.
Install only if you are comfortable with a local automation tool that can type into and send from your active WeChat window. Use it only with an already verified chat visible, review the message manually before allowing any tool call, and remove or redesign the screenshot-writing and confirmation behavior before using it with sensitive contacts or messages.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
server.py:8- Finding
Global GUI Automation Disables the Emergency Abort and Fails Open on Activation Errors
- Content
View full analysis
500: win = w break if not win: return False, "未找到聊天窗口" # 方式1: 按 Enter 发送 pyautogui.press('enter') time.sleep(0.5) # 方式2: 如果Enter没发送，点击发送按钮 # 发送按钮通常在输入框右侧 send_x = win.left + win.width - 50 send_y = win.top + win.height - 35 pyautogui.click(send_x, send_y) time.sleep(0.3) # 确认发送结果 img = capture_window() if img: img.save(str(Path(__file__).parent / "result.png")) return True, None ``` ### Technical Analysis PyAutoGUI keyboard and mouse actions are global desktop events. Finding a window object does not ensure it remains in the foreground when an event is issued. Since activation exceptions are suppressed, automation continues even when activation fails. Disabling `pyautogui.FAILSAFE` removes the standard mechanism that allows a user to abort automation by moving the pointer to a screen corner. Furthermore, `send_message()` always presses Enter and subsequently clicks a presumed Send-button coordinate. There is no actual test establishing that Enter failed, that the click target is a Send button, or that the intended window still occupi ...[truncated 1301 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
server.py:67- Finding
Sensitive WeChat Content Is Persisted in Plaintext Screenshot Files
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
requirements.txt:1- Finding
Unbounded Dependency Versions Permit Unreviewed Future Releases
- Content
View full analysis
=0.9.54 pygetwindow>=0.0.9 pytesseract>=0.3.13 Pillow>=12.1.0 pyperclip>=1.11.0 opencv-python>=4.13.0 ``` The documentation also recommends installing unconstrained packages directly: ```bash pip install pyautogui pygetwindow pillow pyperclip opencv-python ``` ### Technical Analysis Using `>=` without an upper bound or lockfile allows package installation to resolve to arbitrary future versions that were unavailable and therefore unreviewed when the skill was audited. Direct `pip install` commands without versions or hashes have the same problem. Python package installation can execute package build-system code, and installed dependencies execute with the privileges of the user running the skill. A compromised upstream release, account takeover, or incompatible future release could therefore introduce malicious or unsafe behavior after this project has already been reviewed. The documented list also differs from `requirements.txt`: `pytesseract` is listed in the latter but omitted from the installation command. This inconsistency further reduces reproducibility. No evidence was found that any currently named package is malicious; the issue is the unsafe resolution policy. ### Attack Path 1. A future dependency release is compromised, maliciously published, or contains a serious regression. 2. A user follows the documentation or installs from `requirements.txt`. 3. The package resolver selects the newer, unreviewed release because only a lower bound is specified. 4. Package build or installation logic executes, or malicious code runs when imported. 5. The dependency gains the privileges of the user who installed or launched the skill. ### Im ...[truncated 400 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (15)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
The skill’s declared purpose is narrowly framed as sending WeChat messages, but the documentation also describes screenshot capture of the WeChat window and exposes a status/introspection capability about the local app window. That mismatch is security-relevant because users or higher-level agents may grant or invoke the skill assuming a limited send-only scope, while it can also collect UI data and operate on the currently focused chat, increasing the chance of privacy leakage or sending to the wrong recipient.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill captures screenshots of WeChat windows and later saves multiple images of chats, search results, and typed content to disk, which can expose private conversations, contact lists, and message contents beyond what is needed to send a message. Persisting this data creates a confidentiality risk because other local users, malware, backups, or logs may access the images.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The tool directly performs GUI automation to input and send messages with no user confirmation, recipient verification, or final review step. In an agent setting this is especially risky because accidental, malicious, or misrouted tool invocations can immediately transmit content to real contacts.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The file's natural-language docstrings, tool descriptions, status/error messages, and UI assumptions are entirely in Chinese, with no opt-in or alternative locale support. Under the policy, forcing a specific language without user choice is a natural-language locale violation unless clearly justified as region-specific.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Writing screenshots of chat/search windows to disk without clear disclosure unnecessarily persists sensitive UI content, including contacts and messages. Even if intended for debugging, undisclosed local storage of such artifacts expands the data exposure surface and can leak private information long after the operation completes.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The code copies the provided message into the system clipboard without disclosure, which can overwrite the user's clipboard and expose sensitive message contents to other applications, clipboard history, remote desktop sync, or OS-level telemetry. Clipboard-based automation is common, but doing it silently with potentially sensitive content is a privacy and integrity issue.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The exposed tool interface advertises message sending but only operates on the currently focused/open chat window, while the skill description claims it can send to a specified contact. This mismatch creates a dangerous integrity flaw: an agent or user may believe the recipient is controlled when in reality the automation can send to whichever conversation is active, causing misdelivery of sensitive or harmful messages.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
The dependency is specified with a lower bound only, so builds may resolve to different versions over time, including versions with newly introduced regressions or vulnerable transitive combinations. In a skill that automates a desktop messaging client, supply-chain integrity matters because compromised packages could gain the same local-user capabilities as the automation process.
- Content
text pyautogui>=0.9.54 pygetwindow>=0.0.9 pytesseract>=0.3.13 Pillow>=12.1.0
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
Using an unpinned pygetwindow version makes installation non-reproducible and can silently pull in future releases with security or stability issues. Because this skill interacts with desktop windows on Windows, any compromised dependency could help manipulate UI state or observe user context under the current user's privileges.
- Content
text pyautogui>=0.9.54 pygetwindow>=0.0.9 pytesseract>=0.3.13 Pillow>=12.1.0 pyperclip>=1.11.0
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
An unpinned pytesseract dependency allows different environments to install different versions, weakening reproducibility and making it hard to verify whether known issues are fixed. In this skill, OCR is part of desktop automation, so dependency compromise could influence what is read from screen content or how the host process behaves.
- Content
text pyautogui>=0.9.54 pygetwindow>=0.0.9 pytesseract>=0.3.13 Pillow>=12.1.0 pyperclip>=1.11.0 opencv-python>=4.13.0
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
Pillow is unpinned despite having a history of security advisories, so the manifest does not guarantee installation of a non-vulnerable release. Given this skill also processes screenshots/images for automation, an affected imaging library could expose the host to image parsing flaws such as denial of service or, in some versions, more serious memory-safety issues.
- Content
text pyautogui>=0.9.54 pygetwindow>=0.0.9 pytesseract>=0.3.13 Pillow>=12.1.0 pyperclip>=1.11.0 opencv-python>=4.13.0
Unverifiable Dependency: Pillow has 16 known advisory(ies) (CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 92% confidence
- Finding
Pillow has known advisories, and because the dependency is not pinned, it is impossible to determine from this manifest whether deployment will use a patched or vulnerable release. This is more relevant in this skill than in a generic app because image handling is core to desktop automation, increasing the chance that vulnerable parsing paths are reachable.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
An unpinned pyperclip version creates a supply-chain and reproducibility risk because future package releases may alter behavior or introduce vulnerabilities without any manifest change. In a messaging automation skill, clipboard access is sensitive because manipulated or malicious package behavior could expose or tamper with copied content.
- Content
text pygetwindow>=0.0.9 pytesseract>=0.3.13 Pillow>=12.1.0 pyperclip>=1.11.0 opencv-python>=4.13.0
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
opencv-python is unpinned even though the package ecosystem around image parsing and native bindings has had multiple advisories. Since this skill likely uses OpenCV for screen/image analysis in a local desktop context, installing an unsafe version could expose the host to crashes, resource exhaustion, or native-code vulnerabilities when processing image data.
- Content
text pytesseract>=0.3.13 Pillow>=12.1.0 pyperclip>=1.11.0 opencv-python>=4.13.0
Unverifiable Dependency: opencv-python has 16 known advisory(ies) (CVE-2017-12864 (Integer Overflow or Wraparound in OpenCV); CVE-2017-12598 (Out-of-bounds Read in OpenCV ); CVE-2019-14493 (NULL Pointer Dereference in OpenCV.) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 92% confidence
- Finding
opencv-python has multiple known advisories, and the lack of an exact version means the security posture of the installed package cannot be verified from the manifest. Because OpenCV includes native code and is likely exercised by screenshot/image analysis features in this skill, unresolved version ambiguity increases the risk of exposing the host to known vulnerable code paths.
- Content
Static analysis
No suspicious patterns detected.