Security audit

微信文件助手

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent and local-only, but it can scan and persistently index sensitive WeChat file contents without built-in retention, deletion, encryption, or a separate consent step.

Install only if you are comfortable with a local index of WeChat file names, paths, metadata, hashes, and extracted document text being stored under your Windows user profile. Prefer using an explicit --root path for searches, review the local scripts before running commands with ExecutionPolicy Bypass, and delete the LOCALAPPDATA\Codex\wechat-file-finder index if you no longer want the cached content kept.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The default prompt tells the agent to use the skill to find local WeChat files and then 'continue completing the file processing task I request,' which is an open-ended invocation without clear scope limits. In a skill that accesses local Windows files, this broad delegation can let downstream user prompts trigger sensitive file discovery, content inspection, summarization, comparison, or organization actions beyond a narrowly defined, consented search task.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The documentation repeatedly instructs users to run a PowerShell script with `-ExecutionPolicy Bypass`, which suppresses an important Windows script safety control. In this skill context, the command targets a local wrapper script rather than arbitrary remote content, so the issue is not inherently critical; however, normalizing bypass usage increases the chance that a tampered or replaced script will be executed without the user noticing the reduced protection.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The script recursively enumerates files across inferred WeChat storage roots and returns sensitive metadata such as file paths, timestamps, account hints, sender, chat, and sent time without any consent prompt, scope confirmation, or minimization. In the context of a messaging-file finder, this materially increases privacy risk because WeChat file trees can reveal personal identities, conversations, and activity patterns even when file contents are not opened.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The tool extracts content from local documents, including PDFs and Office files, and stores that content persistently in a SQLite database under LOCALAPPDATA. In the context of a WeChat file-finder, this can duplicate sensitive personal or business data into a second, searchable store without clear disclosure, retention limits, access controls, or encryption, increasing exposure if the host or user profile is later accessed by another local process or user.

Static analysis

No suspicious patterns detected.