Wechat Mcp

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:44 AM UTC
• Version: 1.0.0

Overview

This skill can automate WeChat message sending and save chat screenshots, but it lacks reliable recipient checks, confirmation, and clear disclosure of the local desktop access it uses.

Install only if you are comfortable giving the skill control of your Windows desktop WeChat session. It can activate a chat window, overwrite the clipboard with the outgoing message, paste and send automatically, and leave screenshots of chats on disk. Use it only in a least-privileged environment and only after adding recipient verification, an explicit confirmation step, screenshot cleanup or opt-in diagnostics, and pinned dependencies.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: server.py:55

Finding

Sensitive WeChat Screenshots Persisted at Predictable Paths

Content

View full analysis

Vulnerability Details

File Location: server.py:55-57, server.py:97-99, and server.py:117-119
Vulnerability Type: Predictable plaintext storage of sensitive screenshots
Risk Level: Medium

Vulnerable Code:

python

img = capture_window()
if img:
    img.save(str(Path(__file__).parent / "verify.png"))

python

input_bbox = (win_left, win_bottom - 80, win_right, win_bottom - 20)
input_img = ImageGrab.grab(bbox=input_bbox)
input_img.save(str(Path(__file__).parent / "input_verify.png"))

python

img = capture_window()
if img:
    img.save(str(Path(__file__).parent / "result.png"))

Technical Analysis

The message workflow captures the WeChat window, message input area, and post-send result and writes those images into the project directory under fixed names. These screenshots may disclose private conversations, contact identities, message contents, and other visible desktop information.

The files are not deleted after use, encrypted, redacted, or created with explicitly restrictive permissions. Their predictable paths also make them straightforward for another local user or process with access to the directory to discover and read. Reusing the fixed names overwrites previous images but does not prevent exposure through backups, indexing services, filesystem snapshots, or concurrent access.

Writing runtime artifacts into the installed project directory can additionally cause availability failures when the package is installed in a read-only location.

Attack Path

1. A user or MCP client invokes the message-sending operation.
2. The application captures the active chat window and the input area.
3. The images are saved as verify.png, input_verify.png, and result.png beside server.py.
4. The files remain after the operation completes.
5. A local user, process, indexing service, backup service, or later application with access to the project directory r ...[truncated 476 chars]

Remediation

View remediation

Remediation Suggestions

• Do not persist verification screenshots by default; perform any necessary validation in memory.
• Place diagnostic capture functionality behind an explicit, informed opt-in setting.
• If persistence is required, use a dedicated temporary directory rather than the package directory.
• Create files with unpredictable names and owner-only permissions.
• Redact chat content, contact names, notifications, and unrelated screen regions before storage.
• Delete temporary captures immediately after processing and implement cleanup for abnormal termination.
• Document what is captured, why it is needed, how long it is retained, and who can access it.
• Handle screenshot failures without interrupting or falsely reporting the message workflow.

T09 · Insecure Skill Coding Practices

Warning

• Location: server.py:7

Finding

GUI Automation Emergency Failsafe Explicitly Disabled

Content

View full analysis

Vulnerability Details

File Location: server.py:7-8
Vulnerability Type: Unsafe GUI automation configuration
Risk Level: Medium

Vulnerable Code:

python

import pyautogui
pyautogui.FAILSAFE = False

Technical Analysis

PyAutoGUI normally provides an emergency interruption mechanism that raises an exception when the pointer is moved to a screen corner. Explicitly disabling FAILSAFE removes this standard user-controlled method of stopping unintended automation.

This is significant because the application selects windows using broad title and size checks, calculates a fixed input position near the bottom of the selected window, pastes caller-controlled text, and presses Enter. It does not verify the intended contact, foreground process identity, or focused input control immediately before sending. A focus change, unexpected UI layout, misleading window title, or stale window state can therefore cause text to be entered into and submitted through an unintended interface.

Attack Path

1. An MCP client invokes wechat_send_message with message content.
2. The application locates a window based primarily on the title Dragon or WeChat and broad size criteria.
3. The target window, focus, selected conversation, or UI layout changes before the paste or Enter operation.
4. The application clicks a calculated coordinate, pastes the supplied content, and presses Enter.
5. The message is sent to the wrong contact or submitted to another focused application.
6. The user cannot use PyAutoGUI's standard corner failsafe to interrupt the operation.

Impact Assessment

This issue does not itself provide privilege escalation. Its scope is the current interactive desktop session and any application receiving the simulated keyboard and mouse events. It may cause unauthorized or misdirected messages, disclosure of caller-supplied content, or unintended actions in another focused application. The effe ...[truncated 67 chars]

Remediation

View remediation

Remediation Suggestions

• Keep pyautogui.FAILSAFE enabled.
• Provide a documented keyboard or pointer-based cancellation mechanism.
• Activate the target window and verify its process identity, title, bounds, and foreground status immediately before both paste and send operations.
• Verify the selected contact or conversation and display it to the user before sending.
• Require explicit confirmation for messages unless the caller has configured a narrowly scoped recipient allowlist.
• Validate that the intended message input control has focus instead of relying solely on fixed screen coordinates.
• Abort safely if focus changes at any point in the operation.
• Prefer an authenticated, structured messaging API over coordinate-based GUI automation where available.

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Unpinned and Unnecessarily Broad Third-Party Dependencies

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1-6
Vulnerability Type: Non-reproducible dependency resolution and expanded supply-chain surface
Risk Level: Low

Vulnerable Code:

text

pyautogui>=0.9.54
pygetwindow>=0.0.9
pytesseract>=0.3.13
Pillow>=12.1.0
pyperclip>=1.11.0
opencv-python>=4.13.0

The installation guidance in SKILL.md:19-23 also instructs users to install packages without fixed versions:

bash

pip install pyautogui pygetwindow pillow pyperclip opencv-python

Technical Analysis

Every dependency uses a lower-bound constraint rather than a reviewed exact version, while the documented installation command contains no version constraints. As a result, installations performed at different times can resolve to different package versions. Future releases can therefore enter the environment without being covered by the audit of this source tree.

Python packages and their build systems can execute code during installation, and imported dependencies execute code in the context of the user running the Skill. No malicious dependency is established by the reviewed evidence; the weakness is the absence of reproducible dependency controls.

The reviewed server.py does not import pytesseract or opencv-python, so those declared dependencies appear unnecessary for the current implementation and increase the number of third-party components that must be trusted and maintained.

Attack Path

1. A user installs dependencies using requirements.txt or the unversioned command in SKILL.md.
2. The package resolver selects the newest versions satisfying the broad constraints at installation time.
3. A future compromised, vulnerable, or incompatible release is selected without a source-code change in this project.
4. Package installation, import, or runtime behavior executes that dependency in the installing user's security context.
5. Any resu ...[truncated 732 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every direct and transitive dependency to reviewed versions through a generated lock file.
• Use cryptographic hashes and hash-enforced installation where supported.
• Update SKILL.md so installation uses the same locked dependency set rather than an unconstrained pip install command.
• Remove pytesseract and opencv-python unless functionality requiring them is implemented.
• Test dependency updates in isolation and review release notes and provenance before changing pins.
• Run vulnerability and license scanning against the resolved lock file in continuous integration.
• Install and run the Skill in a least-privileged virtual environment.
• Prefer trusted package indexes and prohibit unexpected alternate indexes or dependency sources.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (19)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill description presents this as WeChat monitoring and sending for specified contacts, but the documented capabilities rely on UI automation primitives that can access local resources such as screenshots, window metadata, clipboard contents, and keyboard/mouse control. This mismatch is dangerous because users may grant or invoke the skill under incomplete assumptions, while the real behavior enables broader privacy-sensitive desktop interaction and potential unintended message delivery.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The tool is described as sending messages to a specified contact, but the implementation actually sends to whichever WeChat/target chat window is currently detected. That mismatch can cause messages to be sent to the wrong person or conversation, creating privacy, integrity, and social-engineering risks, especially because sending is automated with no recipient verification.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The tool performs GUI automation to paste and send a message immediately, without any user confirmation, preview, or explicit warning at call time. In a messaging context, this is especially risky because a mistaken window match or malicious prompt chain can trigger irreversible outbound communication to the wrong recipient.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill automates a privacy-sensitive communication app and claims message monitoring/sending, yet its description lacks a clear warning that it can activate WeChat windows, manipulate input, and potentially expose private chat content via screenshots or automation. In this context, inadequate disclosure increases the risk of accidental misuse, unauthorized messaging, and user surprise about the scope of desktop access.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The code specifically searches for a window titled 'Dragon' while the skill is presented as a WeChat messaging tool. This contradiction broadens the automation target beyond the claimed scope and increases the chance of interacting with the wrong application or a disguised window, which is dangerous in a GUI automation tool that clicks, pastes, and sends without strong validation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Natural-language strings throughout the file, including tool descriptions, status messages, and docstrings, are presented only in Chinese. The skill does not offer a language choice or document that it is intentionally limited to a Chinese-speaking or region-specific environment, which can violate language/locale policy requirements.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill captures screenshots of the active chat/application window and saves them to disk, which can expose message contents, contact names, and other sensitive on-screen data unrelated to the narrow task of sending a message. In this context, the screenshots are not strictly required for core functionality and create avoidable privacy and data-retention risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Saving screen captures of chat windows to disk without clear disclosure creates a privacy risk because those images may contain sensitive conversations, contact details, and other unrelated on-screen information. Persisted files also expand the attack surface by leaving recoverable artifacts on disk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The implementation copies the message into the system clipboard before pasting it into WeChat. Clipboard contents are globally accessible to other applications and overwrite the user's prior clipboard data, which can leak sensitive message content or destroy existing clipboard contents without warning.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill modifies the system clipboard without explicit disclosure or consent. This can unexpectedly overwrite sensitive user data already in the clipboard and expose the outgoing message to other local processes that monitor clipboard changes.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency is specified with a lower-bound only (>=), which permits installation of any newer release, including unexpected major versions or compromised upstream releases. In a skill that automates desktop WeChat interaction, unstable or malicious dependency resolution could affect a process with GUI control and clipboard access, increasing supply-chain risk even though the manifest itself is not directly exploitable.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

pyautogui>=0.9.54
pygetwindow>=0.0.9
pytesseract>=0.3.13
Pillow>=12.1.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

Using pygetwindow with only a minimum version allows non-deterministic installs and weakens defenses against supply-chain compromise or breaking changes. Because this skill runs on a Windows desktop and interacts with application windows, a bad dependency version could have direct access to user context and UI automation workflows.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

pyautogui>=0.9.54
pygetwindow>=0.0.9
pytesseract>=0.3.13
Pillow>=12.1.0
pyperclip>=1.11.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The unpinned pytesseract dependency makes builds non-reproducible and may pull in vulnerable or unreviewed future versions. In this skill's context, OCR is part of message monitoring, so dependency compromise could influence processing of user-visible content and local automation behavior.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text

pyautogui>=0.9.54
pygetwindow>=0.0.9
pytesseract>=0.3.13
Pillow>=12.1.0
pyperclip>=1.11.0
opencv-python>=4.13.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

Pillow is unpinned despite a history of security advisories, so the manifest cannot guarantee installation of a safe version. Given this skill likely processes screenshots or image data for OCR/UI automation, a vulnerable or malicious Pillow release raises the risk of code execution or denial of service through crafted image handling paths.

Content

Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.

text

pyautogui>=0.9.54
pygetwindow>=0.0.9
pytesseract>=0.3.13
Pillow>=12.1.0
pyperclip>=1.11.0
opencv-python>=4.13.0

Unverifiable Dependency: Pillow has 16 known advisory(ies) (CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

Pillow has known security advisories, and because the manifest does not pin a specific version, it is impossible to determine whether deployment will select a vulnerable release. This is more concerning here because the skill likely captures or parses GUI screenshots for OCR, increasing the relevance of image-parsing vulnerabilities.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The pyperclip dependency is only lower-bounded, which permits arbitrary newer versions and undermines reproducibility. Since this skill may use the clipboard to send messages, a compromised dependency could interact with sensitive copied content or alter automation behavior.

Content

Scanner excerpt · requirements.txt (reported line 5)May include surrounding context.

text

pygetwindow>=0.0.9
pytesseract>=0.3.13
Pillow>=12.1.0
pyperclip>=1.11.0
opencv-python>=4.13.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

opencv-python is unpinned and has a substantial advisory history, so the project cannot verify whether installed versions are safe. In a desktop automation and OCR skill, OpenCV may process screenshots or image buffers, making vulnerable image-processing code more relevant than in a minimal utility.

Content

Scanner excerpt · requirements.txt (reported line 6)May include surrounding context.

text

pytesseract>=0.3.13
Pillow>=12.1.0
pyperclip>=1.11.0
opencv-python>=4.13.0

Unverifiable Dependency: opencv-python has 16 known advisory(ies) (CVE-2017-12864 (Integer Overflow or Wraparound in OpenCV); CVE-2017-12598 (Out-of-bounds Read in OpenCV ); CVE-2019-14493 (NULL Pointer Dereference in OpenCV.) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

opencv-python has multiple known advisories, and the lack of version pinning means the installed release may still be vulnerable. Because this skill's functionality suggests active image/screen processing in a privileged desktop user session, exploitable flaws in OpenCV are more operationally significant than in a non-visual package.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The file's only user-facing description is the Chinese-only docstring "微信 MCP 测试工具", which imposes a specific language/locale without offering any alternative or opt-in. This matches the policy category for language or locale constraints that are not user-selectable or explicitly justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.