T09 · Insecure Skill Coding Practices
Error
- Location
server.py:57- Finding
Private WeChat Content Persisted in Unprotected Screenshot Files
- Content
View full analysis
- Remediation
View remediation
Security audit
微信MCP
Security checks for vulnerabilities and agentic risk
Overview
This skill appears intended for WeChat desktop automation, but it can send real messages and leave private chat screenshots and clipboard contents behind without enough user control or disclosure.
Install only if you are comfortable granting an agent control over your local WeChat window. Review or modify the skill so it asks for explicit confirmation before sending, requires an exact recipient, avoids saving screenshots during normal use, restores the clipboard after pasting, and limits diagnostics to WeChat-only windows.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Warning
- Location
server.py:143- Finding
Outgoing Message Content Remains in the Global System Clipboard
- Content
View full analysis
- Remediation
View remediation
other
Warning
- Location
find_windows.py:3- Finding
Diagnostic Utility Enumerates All Visible Desktop Windows
- Content
View full analysis
100: # 只显示比较大的窗口 windows.append((hwnd, title, rect, w, h)) windows = [] win32gui.EnumWindows(lambda h, ctx: find_wechat_windows(h, windows), None) for hwnd, title, rect, w, h in windows: print(f'{hwnd}: "{title}" - {w}x{h} @ {rect}') ``` ### Technical Analysis Although the function is named `find_wechat_windows`, it does not filter enumerated windows by WeChat process, window class, or title. It collects and prints the handles, titles, coordinates, and dimensions of every visible top-level window wider than 100 pixels. Window titles may disclose open documents, websites, meeting names, usernames, communication applications, or other activity unrelated to the declared WeChat automation purpose. Handles and geometry additionally expose details about the user's desktop layout and running applications. ### Attack Path 1. An attacker or untrusted automation invokes `find_windows.py`. 2. `EnumWindows` traverses every top-level desktop window. 3. The script reads titles and geometry for visible windows. 4. It prints the collected information to standard output. 5. A calling process captures the output and uses it to profile user activity or identify sensitive applications and documents. ### Impact Assessment The script can disclose desktop metadata available to the current interactive user. It does not elevate privileges or directly read document contents, but window titles alone may reveal sensitive personal or organizational information. The collectio ...[truncated 101 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
requirements.txt:1- Finding
Dependencies Are Installed Without Reproducible Version and Integrity Controls
- Content
View full analysis
=0.9.54 pygetwindow>=0.0.9 pytesseract>=0.3.13 Pillow>=12.1.0 pyperclip>=1.11.0 opencv-python>=4.13.0 ``` The installation documentation also instructs users to install dependencies without fixed versions: ```bash pip install pyautogui pygetwindow pillow pyperclip opencv-python ``` ### Technical Analysis The dependency file uses open-ended lower bounds and does not provide package hashes. The installation instructions are less restrictive and request the latest versions available from the active pip index. As a result, two installations performed at different times may receive different code. A future compromised release, unsafe package-index configuration, or unexpected incompatible release could execute with the privileges of the user performing installation or running the Skill. No evidence was found that the currently named packages are malicious; the finding concerns the absence of reproducible dependency and integrity controls. The documentation and `requirements.txt` are also inconsistent because the documented command omits some declared dependencies and all version constraints. ### Attack Path 1. A user follows the documented `pip install` command or installs from `requirements.txt`. 2. Pip queries the configured package index and resolves mutable package versions. 3. A compromised, substituted, or otherwise unsafe future package version is selected. 4. Package installation hooks or imported package code execute in the user's environment. 5. The dependency obtains the permissions available to the installing or executing Python process. ### Impact Assessment If a dependency or configured package source is compromised, arbitrary code could run with the current user's privileges. That code could access files, environ ...[truncated 331 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (26)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
If the skill performs OCR/contact-name recognition and local screenshot capture rather than the stated message-monitoring/sending workflow, the documentation creates a misleading trust boundary. Misrepresentation of capabilities is dangerous because users may expose chat sessions or approve automation without understanding that image capture and recognition are occurring.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
If the skill performs OCR/contact-name recognition and local screenshot capture rather than the stated message-monitoring/sending workflow, the documentation creates a misleading trust boundary. Misrepresentation of capabilities is dangerous because users may expose chat sessions or approve automation without understanding that image capture and recognition are occurring.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
If the skill performs OCR/contact-name recognition and local screenshot capture rather than the stated message-monitoring/sending workflow, the documentation creates a misleading trust boundary. Misrepresentation of capabilities is dangerous because users may expose chat sessions or approve automation without understanding that image capture and recognition are occurring.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
If the skill performs OCR/contact-name recognition and local screenshot capture rather than the stated message-monitoring/sending workflow, the documentation creates a misleading trust boundary. Misrepresentation of capabilities is dangerous because users may expose chat sessions or approve automation without understanding that image capture and recognition are occurring.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The tool sends the message by pressing Enter without an explicit confirmation immediately before the irreversible action. Because it relies on GUI focus and weak window identification, a small targeting error can result in unintended transmission to the wrong contact, making the operational context especially risky.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The usage examples encourage automated message sending but do not prominently warn that GUI automation can target the wrong conversation if window focus, title parsing, or contact detection is incorrect. In a messaging context, misdelivery can leak sensitive information to unintended recipients and trigger irreversible outbound communication.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The MCP tool definition exposes a live message-sending action without clearly stating that it activates the WeChat window and sends to the current chat context. In agentic use, that omission is risky because tool consumers may treat it like a sandboxed API rather than real GUI automation capable of sending unintended real-world messages.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The helper includes a capability to capture a large portion of the WeChat window via ImageGrab.grab, which can collect full chat history and other on-screen sensitive content unrelated to sending an auto-reply. In a desktop automation skill, this expands the trust boundary significantly and creates privacy and unauthorized collection risks even if the image is only intended for local use.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The code captures the current WeChat chat area and persists it to disk as last_chat.png, which collects message content beyond the stated functionality of monitoring and sending replies. Persisting screenshots creates a local data exposure risk because chat contents may include sensitive personal or business information and the file can be accessed later by other users, processes, backups, or forensic tools.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Writing chat screenshots to disk without any notice or consent silently creates a recoverable record of private conversations. This increases the chance of accidental disclosure through shared machines, malware, cloud sync, logs, backups, or subsequent misuse by other components.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The code enumerates every visible top-level window on the desktop and prints each window's title, size, and position, without restricting collection to WeChat. Window titles can contain sensitive information such as document names, chat subjects, email subjects, or application context, so this creates unnecessary desktop-wide information disclosure beyond the stated skill purpose.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The code captures and persists screenshots of the WeChat contact-name area and full chat window to local files, which exceeds the stated purpose of merely monitoring/sending messages. Those images can contain sensitive conversation content, contact identities, and other desktop information, creating unnecessary local data exposure and retention risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Clipboard-based insertion occurs automatically with no user-facing warning or approval, so the tool can silently replace clipboard contents and stage text into the active chat. In desktop automation, that creates a safety and privacy issue because the user may not realize a global OS resource has been modified.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
When no contact is provided, the tool falls back to auto-detecting or using the current chat window, which can cause messages to be sent to an unintended recipient. In a GUI-automation context, window focus and title detection are brittle, so this behavior materially increases the chance of misdelivery of sensitive or harmful messages.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The script captures a portion of the WeChat window and saves it to a predictable local file without explicit consent, notice, or any protection for the captured content. In the context of a skill designed to monitor and send WeChat messages, this can expose private contact names or message-related UI data to disk where other local users, tools, or later processes may access it.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
The dependency is specified with a lower-bound only, which permits installation of any newer release and makes builds non-reproducible. In a security-sensitive automation skill that controls a desktop messaging client, this increases supply-chain risk because a compromised or vulnerable future release could be pulled without review.
- Content
text pyautogui>=0.9.54 pygetwindow>=0.0.9 pytesseract>=0.3.13 Pillow>=12.1.0
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
Using
pygetwindow>=0.0.9leaves the installed version unconstrained above the minimum, so dependency resolution may select unreviewed releases. This is a supply-chain hygiene weakness and is more concerning here because the skill interacts with local application windows on a Windows desktop.- Content
text pyautogui>=0.9.54 pygetwindow>=0.0.9 pytesseract>=0.3.13 Pillow>=12.1.0 pyperclip>=1.11.0
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
The unpinned
pytesseractdependency allows arbitrary newer versions to be installed, preventing reproducible and reviewable builds. While not an immediate exploit by itself, it creates exposure to future malicious or vulnerable releases in the dependency chain.- Content
text pyautogui>=0.9.54 pygetwindow>=0.0.9 pytesseract>=0.3.13 Pillow>=12.1.0 pyperclip>=1.11.0 opencv-python>=4.13.0
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
Pillow>=12.1.0is not pinned, so the environment may install any later version, including one with newly introduced flaws or a compromised release. This is more dangerous than a generic library here because image parsing libraries often process untrusted content and Pillow has a history of security advisories.- Content
text pyautogui>=0.9.54 pygetwindow>=0.0.9 pytesseract>=0.3.13 Pillow>=12.1.0 pyperclip>=1.11.0 opencv-python>=4.13.0
Unverifiable Dependency: Pillow has 16 known advisory(ies) (CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
The manifest does not pin Pillow, and the package has multiple known advisories across versions, so it is impossible to verify whether deployments are using an affected release. Given that Pillow is an image-processing library and this skill appears to use OCR/screen automation, vulnerable image handling could increase the chance of denial of service or worse depending on the specific version.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 93% confidence
- Finding
pyperclip>=1.11.0permits unreviewed newer versions and makes builds non-deterministic. In this skill, clipboard access is part of the automation surface, so dependency integrity matters even if the manifest issue itself is a low-severity supply-chain weakness.- Content
text pygetwindow>=0.0.9 pytesseract>=0.3.13 Pillow>=12.1.0 pyperclip>=1.11.0 opencv-python>=4.13.0
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
opencv-python>=4.13.0leaves the installed version open-ended, which can result in pulling vulnerable or malicious future releases. This is particularly relevant because OpenCV is a complex native package with a substantial historical vulnerability surface and may process image data in the automation workflow.- Content
text pytesseract>=0.3.13 Pillow>=12.1.0 pyperclip>=1.11.0 opencv-python>=4.13.0
Unverifiable Dependency: opencv-python has 16 known advisory(ies) (CVE-2017-12864 (Integer Overflow or Wraparound in OpenCV); CVE-2017-12598 (Out-of-bounds Read in OpenCV ); CVE-2019-14493 (NULL Pointer Dereference in OpenCV.) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
Because
opencv-pythonis unpinned and the package has many known advisories, the actual security posture cannot be determined from this manifest. In a desktop automation skill using OCR/computer vision, an affected OpenCV build could expose the host to parser or memory-safety issues when handling crafted image inputs.- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill copies the outgoing message into the system clipboard, affecting a shared OS resource not disclosed by the high-level tool description. This can overwrite user clipboard contents and briefly expose sensitive text to other applications or clipboard monitors on the host.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The docstring and window lookup rely on the Chinese application name '微信', which assumes a specific locale and client language. This creates a language/locale constraint without user opt-in or documented justification.
- Content
Static analysis
No suspicious patterns detected.