Security audit

Wecom Deep Op

Security checks across malware telemetry and agentic risk

Overview

This appears to be a legitimate WeCom automation skill, but it should be reviewed carefully because it can read, edit, cancel, and delete real enterprise data using a bot credential without built-in confirmation safeguards.

Install only if you intend to let an agent operate WeCom documents, schedules, meetings, todos, and contacts. Use a dedicated least-privilege bot, keep uaKey values out of source control, logs, screenshots, and shell history, verify every WECOM_*_BASE_URL points to the intended WeCom endpoint, restrict contact visibility, and require human confirmation in your workflow before edit, cancel, delete, or bulk contact actions.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (11)

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The README makes a strong privacy claim that the skill does not record business data except debug logs, yet earlier examples show logging business fields such as task titles. This creates a misleading security posture: operators may enable or retain logs assuming sensitive operational data is not recorded, when in fact user/business content may appear in logs.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The document makes an over-broad safety claim that the skill only reads environment variables and does not recognize bot identifiers, while elsewhere it explicitly documents acceptance of full user-supplied base URLs and mcporter.json entries that can embed uaKey credentials. This mismatch can mislead reviewers and users about the actual credential-handling surface, increasing the chance of unsafe configuration, accidental secret exposure in logs, or improper trust in the package's security model.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The quickstart instructs users to place credential-bearing `uaKey` values directly in URLs and configuration, while simultaneously enabling broad read/write permissions for documents, schedules, meetings, todos, and contacts. Even though the file notes that `uaKey` is equivalent to a password, it does not adequately warn that these example endpoints grant live, data-impacting access and may be exposed via shell history, logs, screenshots, shared config files, or process listings.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The documentation shows a credential-like `uaKey` embedded directly in URLs and stored in configuration examples without explicitly warning that it is sensitive. This can normalize unsafe handling, leading users to paste secrets into shell history, screenshots, logs, shared config files, or source control, which could enable unauthorized access to WeCom MCP services.

Missing User Warnings

Medium

Confidence: 78% confidence
Finding: The README documents many write and destructive operations—creating, editing, cancelling, deleting enterprise resources—without prominent warnings, confirmation guidance, or guardrails about production impact. In an automation skill for enterprise WeCom data, this increases the risk of accidental misuse, mass changes, or destructive actions by users who may treat the examples as safe to run directly.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill advertises broad enterprise data operations across documents, calendars, meetings, todos, and contacts, but the user-facing description does not clearly warn that these actions can access, modify, or expose sensitive organizational information. In a productivity skill that spans multiple corporate data domains, lack of explicit privacy/authorization warnings increases the risk of overbroad or uninformed use, especially by users who may not understand the data sensitivity of contact lists and internal records.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The configuration examples embed the uaKey directly in query-string URLs, which encourages handling a sensitive credential in a form that is commonly leaked via logs, shell history, config files, screenshots, and error messages. Because this skill provides access to multiple WeCom enterprise services, compromise of the uaKey could enable unauthorized access or actions across documents, schedules, meetings, todos, and contacts.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill exposes write and destructive operations such as document edits, schedule cancellation, meeting cancellation, todo deletion, and status changes, but the documentation does not require explicit confirmation or warn operators before high-impact actions. In an agentic context, this increases the risk of accidental or prompt-induced unauthorized changes to business data and workflows.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The manifest advertises many state-changing and destructive capabilities such as editing documents, cancelling meetings and schedules, and deleting todos, but it does not provide any user-facing warning that these actions modify or remove live WeCom data. In an agent skill context, missing disclosure increases the chance of unintended destructive actions because users may invoke tools without understanding their side effects.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The skill exposes contact listing and search capabilities over the enterprise directory but does not include any privacy notice, scope disclosure, or handling guidance for personal data. In a corporate environment, even limited directory access can enable unnecessary enumeration or disclosure of employee information if users are not informed about what data is being accessed.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: The skill exposes destructive operations such as overwriting documents, canceling schedules/meetings, and deleting todos without any built-in confirmation guard, dry-run mode, or friction for high-risk actions. In an agentic environment, prompt mistakes, ambiguous instructions, or indirect prompt injection could cause irreversible business changes through these tools.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: dist/index.cjs.js:44

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: dist/index.esm.js:40

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: src/index.ts:52