wechat-new-tool

• Analyzed: May 11, 2026, 6:41 AM
• Findings: 1
• Version: 1.0.0
• Hash: e91e0fccec987b427b26f6fce353f34d498885c2508a842c92b85cb2e796e11e
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle contains hardcoded sensitive credentials (WECHAT_APPID and WECHAT_TOKEN) within the wechat.yaml file, which is a significant security risk. Furthermore, wechat_bridge.js routes all WeChat interaction data, including contact lists and message content, to an external third-party endpoint (dashboard.synodeai.com), which poses privacy and data exposure risks despite being aligned with the tool's stated purpose.