Wechat Ip Checker

Security checks across malware telemetry and agentic risk

Overview

The skill is transparent about checking IPs, but it can lead to public WeChat publishing without a clearly required final approval step.

Review before installing. Use this only if you intentionally want an IP-gated WeChat publishing workflow, and require explicit confirmation showing the WeChat account, article, and publish-or-draft action before anything is posted. Also review the separate baoyu-post-to-wechat skill because it performs the actual account action.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The trigger list includes short, generic phrases such as "检查 IP", "wechat ip", and "发布公众号" that can plausibly appear in unrelated user requests. Overly broad activation criteria can cause the skill to be invoked unintentionally, exposing users to unintended actions or routing sensitive tasks to the wrong skill.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal