wechat-auto-reply

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:23 PM UTC
• Version: 1.0.1

Overview

This WeChat auto-reply skill is understandable in purpose, but it asks users to install unreviewed mutable code that can read chats and send messages automatically.

Install only if you trust the external Homebrew tap and are comfortable granting automation access that can inspect WeChat conversations and send messages. Review the installed formula/script before use, prefer confirmation mode for replies, and avoid using it on sensitive chats unless the data-processing path is clear.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:16

Finding

Unverified and Mutable Third-Party Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:16, SKILL.md:19-20, and SKILL.md:91
Vulnerability Type: Supply-chain risk from unverified third-party installation sources
Risk Level: Medium

Vulnerable Code

bash

brew install bjdzliu/openclaw/wechat-auto-reply

bash

brew tap bjdzliu/openclaw
brew install wechat-auto-reply

bash

pip3 install pyobjc

Technical Analysis

The Skill does not include the executable implementation of the advertised automation. Instead, it directs users to install the effective implementation from an externally maintained Homebrew tap and to install an unpinned Python dependency.

No immutable commit, exact package version, checksum, signature verification, lock file, or source-validation procedure is specified. The reviewed SKILL.md therefore cannot guarantee that future installations retrieve the same code that existed at audit time.

The Homebrew formula and package contents can include executable installation or runtime logic. If the external tap, its maintainer account, package publication process, or an upstream dependency is compromised, attacker-controlled code could be delivered to users without requiring changes to this repository. The unpinned pip3 install pyobjc command similarly permits dependency resolution to change over time, weakening reproducibility and supply-chain integrity.

Attack Path

1. A user follows the installation instructions in SKILL.md.
2. Homebrew adds or accesses the external bjdzliu/openclaw tap, while pip resolves the current available Python package and dependencies.
3. An attacker compromises an external maintainer account, repository, release process, or dependency source and publishes a modified formula or package.
4. The package manager downloads and installs the modified content because no immutable version or artifact-integrity check is required.
5. The malicious installation or runtime ...[truncated 897 chars]

Remediation

View remediation

Remediation Suggestions

1. Include the complete executable implementation in the reviewed Skill package so its behavior can be audited alongside SKILL.md.
2. Pin the Homebrew formula and Python dependencies to immutable, reviewed versions or commits.
3. Publish cryptographic checksums or signatures for distributed artifacts and verify them before installation.
4. Use a dependency lock file with hashes for Python packages rather than an unconstrained pip3 install.
5. Document the canonical source repository, maintainers, release process, and expected artifact hashes.
6. Add automated dependency scanning and release-integrity checks to the build pipeline.
7. Minimize the permissions granted to the installed command and explain how users can review or revoke screen-recording and accessibility permissions.
8. Require security review whenever a pinned dependency or external formula is updated.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly supports automatically sending WeChat replies based on OCR and AI confidence, but the description does not warn that message content may be captured, analyzed, and transmitted to an AI component. In a messaging context, this can expose sensitive personal or business communications and can also cause unintended outbound messages without the user fully understanding the privacy implications.

Content

No source excerpt is available for this finding.

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

查看安装路径

bash

which wechat-auto-reply
ls -la ~/.openclaw/workspace/skills/wechat-auto-reply

环境准备

Static analysis

No suspicious patterns detected.