T08 · Insecure Dependencies
Warning
- Location
SKILL.md:40- Finding
Unpinned Third-Party Runtime Dependencies
- Content
View full analysis
- Remediation
View remediation
Security audit
WeChat Messenger
Security checks for vulnerabilities and agentic risk
Overview
This skill does what it claims, but it sends live WeChat messages through brittle desktop automation without confirmation or recipient verification.
Install only if you are comfortable with a skill that takes over your active Windows desktop session and sends real WeChat messages immediately. Use it with non-sensitive messages first, keep the desktop idle while it runs, avoid ambiguous contact names, and prefer adding confirmation, recipient verification, clipboard cleanup, and pinned dependencies before relying on it.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/send.py:69- Finding
Unverified Coordinate-Based Message Delivery Can Target the Wrong Recipient or Application
- Content
View full analysis
{contact} ({time.time()-t0:.1f}s)") return True ``` ### Technical Analysis The script derives fixed click positions from the outer WeChat window rectangle and assumes those positions always correspond to the search box and message input field. It then uses global mouse and keyboard input to paste data and press Enter. The implementation does not verify: - That WeChat remained the foreground window after activation. - That the click reached the intended child control. - That search results finished loading. - That the selected conversation exactly matches the requested contact. - That the message input control has focus before the final paste and Enter. - That a send operation succeeded before printing an `[OK]` result. Window scaling, layout changes, overlays, notifications, timing delays, duplicate contact names, or another application stealing focus can invalidate these assumptions. A local process capable of manipulating focus or placing a window under the calculated coordinates could intentionally capture the input. Even without an attacker, ordinary race conditions can cause confidential messages to be sent to an unintended recipient. ### Attack Path 1. The user invokes ...[truncated 1313 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/send.py:42- Finding
Sensitive Contact and Message Data Remain in the Global Clipboard
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 60% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md --- name: wechat-messenger description: "Send WeChat messages via direct Win32 API. ~2s per message." version: 2.0.0
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill automates live interaction with the WeChat desktop client by taking focus, moving the mouse, sending keystrokes, and pressing Enter, which can send a real message to a real contact without an explicit user-facing warning in the skill description. This creates a meaningful risk of unintended message transmission, interference with the user's active session, and privacy or operational mistakes if the wrong window or contact is selected.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script automatically focuses the WeChat window, selects a contact, pastes attacker- or caller-controlled content, and sends it immediately with Enter, without any confirmation, preview, or recipient validation. In an agent/automation context, this can cause unintended or misdirected messages, social-engineering at scale, or leakage of sensitive data to the wrong contact because GUI automation is brittle and depends on window focus and fixed coordinates.
- Content