WeChat macOS Proxy

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:44 AM UTC
• Version: 1.1.1

Overview

The skill broadly matches its WeChat automation purpose, but it needs Review because it can control a messaging app and stores private chat data in insecure local locations.

Install only if you are comfortable granting screen recording and accessibility control to a tool that can operate WeChat. Treat its logs, screenshots, and exports as private chat records; review and clean /tmp/wechat_proxy and avoid using it on shared machines or for conversations where you lack authorization. Be especially careful with batch-send, export, and listen modes.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/config.sh:17
• Finding: Private WeChat Data Stored in an Unsafe Predictable Temporary Directory<![CDATA[ ## Vulnerability Details **File Location**: `scripts/config.sh:17-21`; sensitive writes occur at `scripts/wechat_proxy.sh:145-147`, `scripts/wechat_proxy.sh:165-173`, and `scripts/wechat_proxy.sh:317-329` **Vulnerability Type**: Predictable temporary directory, insufficient permission enforcement, and potential symlink attacks **Risk Level**: Medium ### Vulnerable Code ```bash TEMP_DIR="/tmp/wechat_proxy" mkdir -p "$TEMP_DIR" # Log file LOG_FILE="$TEMP_DIR/wechat_proxy.log" ``` Sensitive chat screenshots and analysis results are subsequently written beneath this directory: ```bash local chat_screenshot="$TEMP_DIR/chat_${contact_name}_$(date +%s).png" screenshot "$chat_screenshot" local list_screenshot="$TEMP_DIR/chat_list_$(date +%s).png" screenshot "$list_screenshot" local analysis_output="$TEMP_DIR/analysis_$(date +%s).txt" peekaboo see --path "$list_screenshot" --analyze "Find chats with new messages and list contact names and new-message counts" > "$analysis_output" 2>/dev/null ``` Chat exports are also placed beneath the same directory: ```bash local export_dir="$TEMP_DIR/export/$contact_name" mkdir -p "$export_dir" local timestamp=$(date '+%Y%m%d_%H%M%S') local md_file="$export_dir/${contact_name}_${timestamp}.md" ``` ### Technical Analysis The application uses a fixed path under the globally shared `/tmp` namespace. It does not: - Create the directory atomically. - Verify that the directory is owned by the current user. - Reject a symbolic link in place of the expected directory. - Set an owner-only `umask`. - Explicitly assign mode `0700` to directories or `0600` to files. - Remove sensitive screenshots and exports after use. The directory stores screenshots of the entire screen, chat-list analysis, exported chat history, message-bearing logs, and a process ID file. These artifacts can contain highly sensitive personal or business communications. Because `mkdir -p` succeeds when the path already exists, an attacker with local acc ...[truncated 1428 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Create a private runtime directory atomically: ```bash umask 077 TEMP_DIR="$(mktemp -d "${TMPDIR:-/tmp}/wechat_proxy.XXXXXXXX")" || exit 1 chmod 700 "$TEMP_DIR" ``` 2. If a stable directory is required, place it beneath an owner-controlled location such as `${XDG_RUNTIME_DIR}` or `$HOME/Library/Caches`, and verify it before every use: ```bash [ -d "$TEMP_DIR" ] || exit 1 [ ! -L "$TEMP_DIR" ] || exit 1 [ "$(stat -f '%u' "$TEMP_DIR")" -eq "$(id -u)" ] || exit 1 chmod 700 "$TEMP_DIR" ``` 3. Create files with mode `0600` and avoid following symbolic links where supported. 4. Separate runtime state, logs, and exported conversations into distinct protected directories. 5. Delete transient screenshots and analysis files after use, ideally through an `EXIT` trap. 6. Document the sensitivity and retention period of exported conversation data. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/wechat_proxy.sh:224
• Finding: Unvalidated PID File Can Cause Termination of an Unrelated Process<![CDATA[ ## Vulnerability Details **File Location**: `scripts/wechat_proxy.sh:191-192` and `scripts/wechat_proxy.sh:224-230` **Vulnerability Type**: Untrusted PID-file handling and arbitrary same-user process termination **Risk Level**: Medium ### Vulnerable Code The listener writes its PID to the shared temporary directory: ```bash # Create PID file echo $$ > "$TEMP_DIR/listener.pid" log "Listener process PID: $$" ``` The stop command later trusts the file contents and passes them directly to `kill`: ```bash if [ -f "$TEMP_DIR/listener.pid" ]; then local pid=$(cat "$TEMP_DIR/listener.pid") log "Stopping listener process: $pid" rm -f "$TEMP_DIR/listener.pid" kill "$pid" 2>/dev/null log "Listener stopped" else log "No listener process is running" fi ``` ### Technical Analysis The `stop` operation assumes that `listener.pid` was created by the current listener and that it still identifies the correct process. It performs no validation that: - The file is regular, owner-controlled, and not a symbolic link. - Its contents are strictly a positive numeric PID. - The process belongs to the current user. - The process is an instance of `wechat_proxy.sh listen`. - The PID has not been recycled since the listener exited. The PID file resides under the predictable temporary directory described in the preceding finding. An attacker able to create or replace it can choose the process targeted by `kill`. ### Attack Path 1. The attacker identifies a process owned by the victim that should be disrupted. 2. The attacker places that process ID into `/tmp/wechat_proxy/listener.pid`, either by controlling the temporary directory or by replacing an insufficiently protected PID file. 3. The victim or an automated Agent invokes: ```bash scripts/wechat_proxy.sh stop ``` 4. The script reads the attacker-selected PID and executes `kill "$pid"`. 5. If the victim has permission to signal that process, the process receives the default termination signal ...[truncated 621 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Store the PID file in an owner-only runtime directory with mode `0700`. 2. Create the PID file atomically and reject symbolic links. 3. Validate the PID before using it: ```bash pid="$(cat "$PID_FILE")" || exit 1 [[ "$pid" =~ ^[1-9][0-9]*$ ]] || exit 1 ``` 4. Verify process ownership and identity before signaling it. On macOS, inspect the process command and owner using `ps`: ```bash [ "$(ps -o uid= -p "$pid" | tr -d ' ')" = "$(id -u)" ] || exit 1 ps -o command= -p "$pid" | grep -F -- "$SCRIPT_DIR/wechat_proxy.sh listen" >/dev/null || exit 1 ``` 5. Record and validate an additional process-start token to mitigate PID reuse. 6. Install cleanup handlers so normal exit removes the PID file: ```bash trap 'rm -f "$PID_FILE"' EXIT INT TERM ``` 7. Prefer process supervision or a private lock mechanism over a bare PID file where practical. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/wechat_proxy.sh:317
• Finding: Unsanitized Contact Names Permit Filesystem Path Traversal<![CDATA[ ## Vulnerability Details **File Location**: `scripts/wechat_proxy.sh:145-147` and `scripts/wechat_proxy.sh:317-322` **Vulnerability Type**: Path traversal through user-controlled filenames **Risk Level**: Medium ### Vulnerable Code The `read` command inserts the contact name directly into a screenshot path: ```bash local chat_screenshot="$TEMP_DIR/chat_${contact_name}_$(date +%s).png" screenshot "$chat_screenshot" log "Chat interface screenshot saved: $chat_screenshot" ``` The `export` command similarly inserts the contact name into directory and filename components: ```bash # Create export directory local export_dir="$TEMP_DIR/export/$contact_name" mkdir -p "$export_dir" local timestamp=$(date '+%Y%m%d_%H%M%S') local md_file="$export_dir/${contact_name}_${timestamp}.md" ``` ### Technical Analysis `contact_name` originates from a command-line argument and is not restricted to a safe basename. Shell quoting prevents shell command injection, but it does not prevent filesystem traversal. Values containing `/`, `..`, or other path-significant characters are resolved by the operating system. For example, a contact value containing repeated `../` components can cause `export_dir`, `md_file`, or the screenshot path to resolve outside the intended `/tmp/wechat_proxy/export` hierarchy. The export code subsequently uses `cat > "$md_file"`, which truncates or creates the resolved destination. The screenshot helper also passes the resolved path to `peekaboo` or `screencapture`, which may create or overwrite an image at that location. ### Attack Path 1. An attacker influences the contact argument supplied to the Skill, such as through an automated Agent request. 2. The attacker supplies a traversal-bearing value, for example a contact name containing multiple `../` components. 3. The script concatenates the value into `export_dir`, `md_file`, or `chat_screenshot`. 4. Filesystem path normalization resolves the destination outside the intended export dir ...[truncated 1043 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Never use the display name directly as a path component. 2. Generate opaque file identifiers, such as a timestamp plus a cryptographically random suffix. 3. If a readable name is required, convert it to a strict safe basename: ```bash safe_contact="$(printf '%s' "$contact_name" | tr '/\\' '__' | sed 's/\.\./_/g; s/[^[:alnum:]_. -]/_/g')" ``` 4. Reject empty names, `.` and `..`, path separators, control characters, and excessively long values. 5. Canonicalize the parent directory and verify that it remains below the approved export root before writing. 6. Open output files using mechanisms that reject symbolic links and existing unexpected files. 7. Keep the original contact name only as content inside the export, with appropriate Markdown escaping. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/wechat_proxy.sh:117
• Finding: Full Contact Names and Message Bodies Are Persisted in Plaintext Logs<![CDATA[ ## Vulnerability Details **File Location**: `scripts/wechat_proxy.sh:98`, `scripts/wechat_proxy.sh:117`, and `scripts/wechat_proxy.sh:268`; log destination defined at `scripts/config.sh:20-21` **Vulnerability Type**: Sensitive data exposure through plaintext logging **Risk Level**: Medium ### Vulnerable Code The send operation logs the contact and complete message body: ```bash log "Preparing to send message to $contact_name" ``` ```bash log "Entering message: $message" ``` The batch-send operation also logs each contact and message: ```bash log "[$total] Sending to $contact: $message" ``` The logging function appends these values to a plaintext file: ```bash log() { echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" | tee -a "$LOG_FILE" } ``` The log destination is predictable: ```bash LOG_FILE="$TEMP_DIR/wechat_proxy.log" ``` ### Technical Analysis Outgoing message bodies and contact identifiers are sensitive communication data. The logging implementation records them in full and appends them indefinitely to `/tmp/wechat_proxy/wechat_proxy.log`. There is no redaction, explicit access-mode enforcement, retention limit, rotation policy, or secure deletion. The message is also emitted to standard output through `tee`, which may cause additional retention in terminal capture, Agent transcripts, process supervisors, or CI logs. Although shell quoting prevents the message from being interpreted as a command, embedded control characters or line breaks can forge additional log entries and make audit records misleading. ### Attack Path 1. The victim sends a private message with `send` or `batch-send`. 2. The script passes the contact and complete message body to `log`. 3. `tee -a` writes the data to the predictable plaintext log and duplicates it to standard output. 4. A local user, support process, transcript collector, backup utility, or other component with access to the file or output stream obtains the communication. 5. Because no rotation or c ...[truncated 577 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not log message bodies under normal operation. 2. Replace sensitive entries with minimal operational metadata: ```bash log "Sending message to a selected contact; length=${#message}" ``` 3. Redact or hash contact identifiers if correlation is required. 4. Apply `umask 077` before creating logs and enforce file mode `0600`. 5. Remove `tee` for sensitive events so log content is not duplicated to standard output. 6. Sanitize carriage returns, line feeds, escape sequences, and other control characters before logging user-controlled fields. 7. Implement bounded rotation, short retention, and secure cleanup. 8. Make verbose content logging an explicit, opt-in diagnostic feature accompanied by a privacy warning. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description is for a macOS WeChat automation utility that sends messages, reads chats, and monitors new messages through GUI automation with peekaboo. The supplied code does none of that. It is a standalone shell script for checking feedback or listing information about the skill 'wechat-macos-proxy' via `clawhub inspect` and `clawhub explore`, then logging the output to `/tmp/wechat_proxy_feedback.log`. This is a materially different primary purpose and uses different resources and capabilities than declared. Therefore, the description does not accurately represent the code chunk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description is for a macOS WeChat automation skill focused on GUI-driven messaging operations. The supplied code does something materially different: it creates a weekly report about the skill's feedback/discoverability on ClawHub, saves it to /tmp, prints it, and suggests manual review actions. It interacts with ClawHub CLI and local files, not with WeChat UI, contacts, chat contents, or message monitoring. This is a clear description-behavior mismatch because the code's primary purpose is reporting/skill feedback inspection rather than WeChat automation.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

if [ -f "$TEMP_DIR/listener.pid" ]; then
        local pid=$(cat "$TEMP_DIR/listener.pid")
        log "停止监听进程: $pid"
        rm -f "$TEMP_DIR/listener.pid"
        kill "$pid" 2>/dev/null
        log "✓ 监听已停止"
    else

• Confidence: 95% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill advertises reading, monitoring, exporting, and auto-replying to WeChat messages, which inherently processes potentially sensitive communications from other people. Without a prominent privacy warning and consent guidance, users may deploy it in ways that collect or act on private chat data without adequate notice, increasing the risk of privacy violations and misuse.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The setup instructions request macOS Screen Recording and Accessibility permissions, both of which are highly privileged and can expose all on-screen content and permit broad UI control. Presenting these steps without clearly explaining their sensitivity can lead users to grant powerful access without understanding that the tool could read unrelated data or automate unintended actions.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation states that screenshots are saved to /tmp/wechat_proxy/, but does not clearly warn that chat content will be written to disk. Even temporary directories can expose sensitive data to other local processes or users depending on system configuration, and users may wrongly assume message reading is ephemeral.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The export feature creates Markdown archives plus screenshots of chat history, which turns transient messages into a persistent local record. Without a strong warning about sensitivity, storage location, access controls, and retention, users may unintentionally create high-risk archives of private conversations.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script can capture full-screen screenshots and save them to a temporary directory without any user-facing notice or consent flow in this file. In the context of a WeChat automation tool, screenshots may contain private chats, contacts, notifications, or unrelated on-screen secrets, so silent capture creates a real privacy and data-exposure risk if invoked unexpectedly or logged/stored insecurely.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The read flow captures a screenshot of the chat UI and saves it to a temporary file, but does not clearly warn the user that conversation content is being persisted locally. Even temporary screenshots can expose sensitive personal or business communications through filesystem access, backups, crash reports, or leftover temp files.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The new-message check takes a screenshot of the chat list and passes it to an analysis command without disclosing whether the image is processed locally or transmitted elsewhere. In a messaging automation context, this can reveal contact names, message previews, and activity patterns to external tools or services without informed consent.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The export flow writes chat screenshots and a Markdown index containing conversation metadata to disk without an explicit consent prompt, retention notice, or access-control guidance. Because this skill handles private WeChat conversations, silent local persistence materially increases privacy and compliance risk if the machine is shared, backed up, or later accessed by malware or another user.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: Comments and all generated report content are written in Chinese, and the date format is also hard-coded to Chinese locale conventions. This imposes a specific language on users without any opt-in or documented justification, which matches the language/locale policy violation criteria.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The manifest describes a macOS WeChat automation tool for sending, reading, and monitoring WeChat messages via GUI automation. This script instead queries ClawHub metadata about the skill itself and builds a weekly feedback report, which is a maintainer/marketing workflow rather than an implementation detail of WeChat message automation.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: Calling `clawhub inspect` and `clawhub explore` reaches outside the local GUI automation domain described in the manifest and introduces external service interaction for skill analytics. That capability is not an obvious requirement for sending messages, reading chats, or monitoring new WeChat messages on macOS.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: This file contains natural-language instructions and examples only in Chinese, which can amount to forcing a specific language or locale if the skill is expected to be generally usable. There is no indication that the user can choose a language or that the locale constraint is explicitly documented as optional or region-specific.

Missing User Warnings

Low

• Confidence: 87% confidence
• Finding: The script programmatically activates and opens WeChat via AppleScript/open, which gives the tool UI-control capability over a messaging app without any warning in this file. While expected for automation, this can still surprise users and be abused to manipulate focus, trigger unintended actions, or facilitate message interaction without sufficiently informed consent.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: This shell script executes external `clawhub` commands and writes their output into a report file under `/tmp`, but the file contains no user-facing warning, confirmation step, or explicit disclosure beyond internal comments. For a code file, subprocess execution and file writes should have some visible disclosure unless clearly communicated to the user.

Static analysis

No suspicious patterns detected.