Security audit

WeChat Send

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says, but it sends real WeChat messages through broad macOS UI automation and contains unsafe scripting that could be abused with crafted inputs.

Review this carefully before installing. Only use it with non-sensitive messages and specific contact names, and expect it to control your Mac's WeChat UI using your logged-in account. The skill should be hardened with safe AppleScript argument passing, confirmation before send, reduced logging, and better UI targeting before routine use.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/wechat_send.sh:34
Finding: AppleScript Injection Through Untrusted Contact and Message Arguments
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/wechat_send.sh:31
Finding: Sensitive Recipient and Message Content Exposed Through Standard Output
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Exfiltration Commands

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.
Content: Scanner excerpt · SKILL.md (reported line 9)May include surrounding context.
md
# WeChat Send Send messages to WeChat contacts by automating the macOS WeChat desktop app. ## Prerequisites

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill automates sending WeChat messages on the user's behalf, which is an external side effect, but the user-facing description does not prominently and explicitly warn that invoking the skill will cause a real outbound message to be sent. That increases the risk of unintended actions, social engineering, or accidental misuse, especially because the skill uses GUI automation and may send to the wrong contact if search results are ambiguous.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The JXA block posts low-level global mouse events through CoreGraphics, which is a broader and more dangerous capability than simply automating message sending. Because the click is coordinate-based and global, a wrong window state or maliciously influenced UI could cause clicks in unintended locations, potentially triggering unrelated actions in other apps or system dialogs.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script overwrites the system clipboard with the message body before pasting it into WeChat, which creates an undisclosed side effect outside the stated skill scope. Clipboard contents may contain sensitive user data, and replacing them can cause privacy loss, workflow disruption, or accidental disclosure if the clipboard is later pasted elsewhere.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script sends the message immediately by issuing an Enter keypress with no confirmation step, making the action irreversible once triggered. In a UI automation context, mistakes in contact selection, message content, or application focus can result in unauthorized or misdirected messages being sent to the wrong recipient.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.