Wechat Qwen Reply

• Outcome: Review
• Latest audit: May 29, 2026 · 9:26 PM UTC
• Version: 0.1.1

Overview

This skill is meant to read WeChat chats with Qwen-VL, but it handles private chat screenshots and local automation with too much unreviewed or under-scoped behavior for automatic approval.

Review before installing. Only use it on chats you are allowed to share with DashScope/Qwen-VL, inspect or obtain the missing PowerShell and AHK scripts first, require manual confirmation before any message sending, and replace the hardcoded personal API-key path with a properly scoped secret.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence
• Finding: The skill documentation describes capabilities that imply reading local files, writing outputs, invoking shell scripts, and sending data over the network, but it does not declare corresponding permissions. This weakens reviewability and user consent because the skill handles screenshots, local artifacts, and external API calls without explicit capability disclosure.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The documented behavior materially exceeds or differs from the declared purpose: it references a fixed local secret path, persists captured data locally, and sends screenshots/chat content to DashScope/Qwen-VL, while the advertised auto-reply behavior is not actually implemented in the described commands. This mismatch can mislead users about what data leaves the machine and what automation occurs, increasing the risk of unauthorized disclosure of private chats and local secrets.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: Publishing a hard-coded absolute path to a user's API key file reveals where sensitive credentials are stored and normalizes direct secret-file access from a fixed location. That makes credential discovery easier for local attackers or overly permissive tooling and encourages insecure secret handling practices.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The script reads an API key from a fixed local secrets file and uses it to transmit captured WeChat screenshots to DashScope, which exposes private chat content to a third-party cloud service. In a chat-reading/auto-reply skill, this materially increases privacy and data-governance risk, especially because the code provides no explicit consent flow, minimization, or disclosure at runtime.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The skill advertises automatic WeChat message sending via AHK and clipboard paste without clearly warning users that it can transmit outbound messages on their behalf. Silent or poorly disclosed outbound automation can cause accidental message delivery, data leakage, or misuse if triggered in the wrong chat context.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation exposes use of a DashScope API key and implies that chat screenshots/text are processed by Qwen-VL, but it does not warn users that private chat content may be transmitted to a third-party service. In this context, the data is highly sensitive because it comes from personal or group WeChat conversations and may include names, files, or financial red-packet content.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The code base64-encodes a screenshot of a WeChat chat and submits it to a remote API, potentially leaking sensitive personal, business, or financial information contained in messages, file cards, or red-packet notices. Because this occurs silently in an automation skill that reads user chats, the context makes the behavior more dangerous: the captured content may include highly sensitive conversations the user did not expect to leave the local machine.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Reading API credentials from a local secrets file is not inherently unsafe, but doing so without disclosure or any guardrails contributes to hidden external-service use and increases the chance of mishandling long-lived credentials. In this skill, the credential directly enables exfiltration of chat screenshots to a cloud API, so the undisclosed secret use is security-relevant.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: Revealing the local filesystem location of a secret file in natural-language documentation increases the chance that operators, companion tools, or malicious prompts will target that path for credential access. Even without the secret contents, path disclosure lowers the barrier to secret harvesting on the host.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.