Security audit

WeChat macOS Proxy

Security checks for vulnerabilities and agentic risk

Overview

The skill broadly matches its WeChat automation purpose, but it needs Review because it can control a messaging app and stores private chat data in insecure local locations.

Install only if you are comfortable granting screen recording and accessibility control to a tool that can operate WeChat. Treat its logs, screenshots, and exports as private chat records; review and clean /tmp/wechat_proxy and avoid using it on shared machines or for conversations where you lack authorization. Be especially careful with batch-send, export, and listen modes.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/config.sh:17
Finding: Private WeChat Data Stored in an Unsafe Predictable Temporary Directory
Content: View full analysis
"$analysis_output" 2>/dev/null ``` Chat exports are also placed beneath the same directory: ```bash local export_dir="$TEMP_DIR/export/$contact_name" mkdir -p "$export_dir" local timestamp=$(date '+%Y%m%d_%H%M%S') local md_file="$export_dir/${contact_name}_${timestamp}.md" ``` ### Technical Analysis The application uses a fixed path under the globally shared `/tmp` namespace. It does not: - Create the directory atomically. - Verify that the directory is owned by the current user. - Reject a symbolic link in place of the expected directory. - Set an owner-only `umask`. - Explicitly assign mode `0700` to directories or `0600` to files. - Remove sensitive screenshots and exports after use. The directory stores screenshots of the entire screen, chat-list analysis, exported chat history, message-bearing logs, and a process ID file. These artifacts can contain highly sensitive personal or business communications. Because `mkdir -p` succeeds when the path already exists, an attacker with local acc ...[truncated 1428 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/wechat_proxy.sh:224
Finding: Unvalidated PID File Can Cause Termination of an Unrelated Process
Content: View full analysis
"$TEMP_DIR/listener.pid" log "Listener process PID: $$" ``` The stop command later trusts the file contents and passes them directly to `kill`: ```bash if [ -f "$TEMP_DIR/listener.pid" ]; then local pid=$(cat "$TEMP_DIR/listener.pid") log "Stopping listener process: $pid" rm -f "$TEMP_DIR/listener.pid" kill "$pid" 2>/dev/null log "Listener stopped" else log "No listener process is running" fi ``` ### Technical Analysis The `stop` operation assumes that `listener.pid` was created by the current listener and that it still identifies the correct process. It performs no validation that: - The file is regular, owner-controlled, and not a symbolic link. - Its contents are strictly a positive numeric PID. - The process belongs to the current user. - The process is an instance of `wechat_proxy.sh listen`. - The PID has not been recycled since the listener exited. The PID file resides under the predictable temporary directory described in the preceding finding. An attacker able to create or replace it can choose the process targeted by `kill`. ### Attack Path 1. The attacker identifies a process owned by the victim that should be disrupted. 2. The attacker places that process ID into `/tmp/wechat_proxy/listener.pid`, either by controlling the temporary directory or by replacing an insufficiently protected PID file. 3. The victim or an automated Agent invokes: ```bash scripts/wechat_proxy.sh stop ``` 4. The script reads the attacker-selected PID and executes `kill "$pid"`. 5. If the victim has permission to signal that process, the process receives the default termination signal ...[truncated 621 chars]
Remediation: View remediation
/dev/null || exit 1 ``` 5. Record and validate an additional process-start token to mitigate PID reuse. 6. Install cleanup handlers so normal exit removes the PID file: ```bash trap 'rm -f "$PID_FILE"' EXIT INT TERM ``` 7. Prefer process supervision or a private lock mechanism over a bare PID file where practical. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/wechat_proxy.sh:317
Finding: Unsanitized Contact Names Permit Filesystem Path Traversal
Content: View full analysis
"$md_file"`, which truncates or creates the resolved destination. The screenshot helper also passes the resolved path to `peekaboo` or `screencapture`, which may create or overwrite an image at that location. ### Attack Path 1. An attacker influences the contact argument supplied to the Skill, such as through an automated Agent request. 2. The attacker supplies a traversal-bearing value, for example a contact name containing multiple `../` components. 3. The script concatenates the value into `export_dir`, `md_file`, or `chat_screenshot`. 4. Filesystem path normalization resolves the destination outside the intended export dir ...[truncated 1043 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/wechat_proxy.sh:117
Finding: Full Contact Names and Message Bodies Are Persisted in Plaintext Logs
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description is for a macOS WeChat automation utility that sends messages, reads chats, and monitors new messages through GUI automation with peekaboo. The supplied code does none of that. It is a standalone shell script for checking feedback or listing information about the skill 'wechat-macos-proxy' via clawhub inspect and clawhub explore, then logging the output to /tmp/wechat_proxy_feedback.log. This is a materially different primary purpose and uses different resources and capabilities than declared. Therefore, the description does not accurately represent the code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description is for a macOS WeChat automation skill focused on GUI-driven messaging operations. The supplied code does something materially different: it creates a weekly report about the skill's feedback/discoverability on ClawHub, saves it to /tmp, prints it, and suggests manual review actions. It interacts with ClawHub CLI and local files, not with WeChat UI, contacts, chat contents, or message monitoring. This is a clear description-behavior mismatch because the code's primary purpose is reporting/skill feedback inspection rather than WeChat automation.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · scripts/wechat_proxy.sh (reported line 228)May include surrounding context.
sh
if [ -f "$TEMP_DIR/listener.pid" ]; then local pid=$(cat "$TEMP_DIR/listener.pid") log "停止监听进程: $pid" rm -f "$TEMP_DIR/listener.pid" kill "$pid" 2>/dev/null log "✓ 监听已停止" else

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill advertises reading, monitoring, exporting, and auto-replying to WeChat messages, which inherently processes potentially sensitive communications from other people. Without a prominent privacy warning and consent guidance, users may deploy it in ways that collect or act on private chat data without adequate notice, increasing the risk of privacy violations and misuse.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The setup instructions request macOS Screen Recording and Accessibility permissions, both of which are highly privileged and can expose all on-screen content and permit broad UI control. Presenting these steps without clearly explaining their sensitivity can lead users to grant powerful access without understanding that the tool could read unrelated data or automate unintended actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation states that screenshots are saved to /tmp/wechat_proxy/, but does not clearly warn that chat content will be written to disk. Even temporary directories can expose sensitive data to other local processes or users depending on system configuration, and users may wrongly assume message reading is ephemeral.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The export feature creates Markdown archives plus screenshots of chat history, which turns transient messages into a persistent local record. Without a strong warning about sensitivity, storage location, access controls, and retention, users may unintentionally create high-risk archives of private conversations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script can capture full-screen screenshots and save them to a temporary directory without any user-facing notice or consent flow in this file. In the context of a WeChat automation tool, screenshots may contain private chats, contacts, notifications, or unrelated on-screen secrets, so silent capture creates a real privacy and data-exposure risk if invoked unexpectedly or logged/stored insecurely.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The read flow captures a screenshot of the chat UI and saves it to a temporary file, but does not clearly warn the user that conversation content is being persisted locally. Even temporary screenshots can expose sensitive personal or business communications through filesystem access, backups, crash reports, or leftover temp files.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The new-message check takes a screenshot of the chat list and passes it to an analysis command without disclosing whether the image is processed locally or transmitted elsewhere. In a messaging automation context, this can reveal contact names, message previews, and activity patterns to external tools or services without informed consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The export flow writes chat screenshots and a Markdown index containing conversation metadata to disk without an explicit consent prompt, retention notice, or access-control guidance. Because this skill handles private WeChat conversations, silent local persistence materially increases privacy and compliance risk if the machine is shared, backed up, or later accessed by malware or another user.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Comments and all generated report content are written in Chinese, and the date format is also hard-coded to Chinese locale conventions. This imposes a specific language on users without any opt-in or documented justification, which matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest describes a macOS WeChat automation tool for sending, reading, and monitoring WeChat messages via GUI automation. This script instead queries ClawHub metadata about the skill itself and builds a weekly feedback report, which is a maintainer/marketing workflow rather than an implementation detail of WeChat message automation.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Calling clawhub inspect and clawhub explore reaches outside the local GUI automation domain described in the manifest and introduces external service interaction for skill analytics. That capability is not an obvious requirement for sending messages, reading chats, or monitoring new WeChat messages on macOS.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This file contains natural-language instructions and examples only in Chinese, which can amount to forcing a specific language or locale if the skill is expected to be generally usable. There is no indication that the user can choose a language or that the locale constraint is explicitly documented as optional or region-specific.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The script programmatically activates and opens WeChat via AppleScript/open, which gives the tool UI-control capability over a messaging app without any warning in this file. While expected for automation, this can still surprise users and be abused to manipulate focus, trigger unintended actions, or facilitate message interaction without sufficiently informed consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This shell script executes external clawhub commands and writes their output into a report file under /tmp, but the file contains no user-facing warning, confirmation step, or explicit disclosure beyond internal comments. For a code file, subprocess execution and file writes should have some visible disclosure unless clearly communicated to the user.
Content: No source excerpt is available for this finding.