Windows Desktop Automation CLI

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:37 AM UTC
• Version: 0.6.0

Overview

This is a real Windows and WeChat automation tool, but it can read private desktop/chat data and perform sensitive account actions that need careful review before use.

Install only if you intend to let an agent inspect and control your Windows desktop. Use it only on your own authorized sessions, keep sensitive apps closed, require explicit confirmation before any WeChat send/post/call/contact/delete/export/logout action, avoid unattended auto-reply, avoid the wxid memory-map method unless there is a justified diagnostic need, and pin dependencies in a virtual environment before use.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: assets/requirements.txt:2

Finding

Unpinned Third-Party Dependencies Permit Supply-Chain Drift

Content

View full analysis

Vulnerability Details

File Location: assets/requirements.txt:2-5, assets/requirements-optional.txt:4-6, and assets/requirements-dev.txt:5-16
Vulnerability Type: Unpinned third-party dependencies without integrity verification
Risk Level: Medium

Vulnerable Code

assets/requirements.txt:2-5:

text

pywinauto>=0.6.8
pywin32>=305
comtypes>=1.2.0
Pillow>=9.0.0

assets/requirements-optional.txt:4-6:

text

opencv-python>=4.5.0
numpy>=1.20.0
wx-ocr>=1.0.0

assets/requirements-dev.txt:5-16:

text

pylint>=2.17.0

# Type checking
mypy>=1.0.0

# Testing
pytest>=7.0.0
pytest-cov>=4.0.0

# Formatting (optional)
black>=23.0.0
isort>=5.12.0

Technical Analysis

Every dependency uses an open-ended minimum-version constraint. Consequently, two installations performed at different times can resolve to different package versions, including future releases that were never audited with this project. The manifests also provide no package hashes, lock file, or index restriction that would verify the provenance and integrity of downloaded distributions.

Python packages can execute code during installation and subsequently run with the privileges of the invoking user when imported. This risk is especially material for this project because its dependencies participate in desktop automation, OCR, screenshots, clipboard operations, and Windows API access. For example, the optional wx-ocr package receives temporary screenshots that may contain sensitive window content.

This finding does not demonstrate that any currently named dependency is malicious. It identifies a supply-chain weakness that would make a compromised or unexpectedly changed release immediately eligible for installation.

Attack Path

1. An attacker compromises a permitted dependency release, its maintainer account, or the package index used by pip.
2. The attacker publishes a malicious vers ...[truncated 1061 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace minimum-version ranges with exact, reviewed versions for production installations.
2. Generate a reproducible lock file for core, optional, and development dependency groups.
3. Record cryptographic hashes and require verification during installation, such as with pip install --require-hashes.
4. Configure an explicitly trusted package index or an internally controlled package mirror.
5. Review dependency provenance, release signatures, maintainers, and transitive dependencies before upgrades.
6. Run dependency vulnerability and provenance scanning in continuous integration.
7. Install dependencies in a dedicated virtual environment under a non-administrative account.
8. Treat OCR dependencies as sensitive components because they process screenshots, and test upgrades in an isolated environment before deployment.

T05 · Unauthorized Access and Privilege Escalation

Note

• Location: assets/wechat/system-tools.md:13

Finding

WeChat Process Memory-Map Reconnaissance Exceeds the Core GUI Automation Scope

Content

View full analysis

Vulnerability Details

File Location: assets/wechat/system-tools.md:13-25
Vulnerability Type: Excessive process inspection and account-identity reconnaissance
Risk Level: Low

Vulnerable Code

python

# Method: traverse the memory mappings of the Weixin.exe process and find paths containing MMKV
# Requires tools such as psutil and cannot be implemented directly with winguictl
# Python script example:
# import psutil, os, re
# for proc in psutil.process_iter(['pid', 'name', 'cmdline']):
#     if proc.info['name'] == 'Weixin.exe':
#         for mem_map in proc.memory_maps():
#             if 'MMKV' in mem_map.path:
#                 wxid_folder = os.path.dirname(mem_map.path).replace('db_storage', '').replace('MMKV', '')
#                 wxid = re.search(r'wxid_\w+\d+', wxid_folder)
#                 print(wxid.group(0) if wxid else '')

Technical Analysis

The documentation directs an agent to enumerate local processes and inspect the memory-mapped files of Weixin.exe to derive the identifier of the currently logged-in WeChat account. This goes beyond ordinary window control and exposes process-level and account-related metadata that is not required for the project's primary GUI automation functions.

The code is presented as a commented documentation example and is not automatically executed by the project. Exploitation therefore requires a user or agent to copy, uncomment, or otherwise run the example. No mechanism that transmits the resulting identifier was found.

Depending on Windows process integrity levels and access controls, psutil.Process.memory_maps() may fail for protected or higher-integrity processes. The example does not itself bypass those controls or elevate privileges. Its security concern is the unnecessary expansion of collection scope and disclosure of account identity and local storage-path metadata.

Attack Path

1. A user or automation agent consults the s ...[truncated 901 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the memory-map inspection example unless account identification is an essential and documented feature.
2. Prefer an official, documented WeChat interface or a user-supplied account identifier instead of process inspection.
3. Require explicit, task-specific user consent before enumerating processes or inspecting memory-map metadata.
4. Clearly label the resulting account identifier and storage path as sensitive information.
5. Avoid printing the full identifier by default; redact it unless complete output is explicitly required.
6. Prevent sensitive results from being retained in routine logs, telemetry, command histories, or agent memory.
7. Do not recommend elevation when access is denied; preserve the operating system's existing privilege boundary.
8. If the capability is retained, isolate it as an opt-in diagnostic operation rather than part of the normal GUI automation workflow.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (75)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The overall capability set is substantially broader than the declared scope: clipboard operations, UI structure inspection, screenshots, OCR, image matching, and wait/polling logic all enable observation and manipulation beyond simple desktop automation. This broad understatement increases the risk of over-privileged use, weak user consent, and unsafe agent planning because the skill can inspect and extract information from the desktop environment, not just control it.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The overall capability set is substantially broader than the declared scope: clipboard operations, UI structure inspection, screenshots, OCR, image matching, and wait/polling logic all enable observation and manipulation beyond simple desktop automation. This broad understatement increases the risk of over-privileged use, weak user consent, and unsafe agent planning because the skill can inspect and extract information from the desktop environment, not just control it.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The overall capability set is substantially broader than the declared scope: clipboard operations, UI structure inspection, screenshots, OCR, image matching, and wait/polling logic all enable observation and manipulation beyond simple desktop automation. This broad understatement increases the risk of over-privileged use, weak user consent, and unsafe agent planning because the skill can inspect and extract information from the desktop environment, not just control it.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This section automates adding contacts, sending verification text, and approving friend requests—actions that change the state of the user's account and may be difficult to undo. Without prominent warnings and explicit confirmation, the skill could be used to spam users, establish unwanted trust relationships, or manipulate a victim's account through unattended automation.

Content

No source excerpt is available for this finding.

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · scripts/win32_utils.py (reported line 238)May include surrounding context.

python

try:
                    memdc.DeleteDC()
                except Exception as e:  # pylint: disable=broad-exception-caught
                    _logger.debug("Failed to delete memory DC: %s", e)
            if dc is not None:
                try:
                    dc.DeleteDC()

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README advertises capabilities to control windows, inject input, inspect UI structures, and capture screenshots, but it does not warn about privacy, consent, or the risk of destructive actions on the host system. For a desktop automation skill, this omission increases the chance of unsafe deployment or misuse because operators may not appreciate that the tool can read sensitive on-screen data and manipulate arbitrary applications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The document provides concrete instructions for continuous message monitoring and automated replying in WeChat without any guardrails about user consent, privacy, platform policy, or account enforcement risk. In the context of a desktop automation skill, this materially enables covert surveillance-like behavior and unattended messaging, which can expose private communications and trigger account restriction or misuse.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill hard-codes Chinese UI labels such as "语音聊天", "视频聊天", "接听", and "拒绝" without documenting that it only works for a Chinese-localized WeChat UI or requiring user confirmation of locale. In a desktop automation context, brittle text-based selectors can mis-target controls or fail unpredictably on other locales or versions, causing unintended calls, hangs, or interaction with the wrong window elements.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly documents how to enumerate a user's WeChat contact list and extract profile information via UI automation, but provides no consent, authorization, or privacy warning. Contact names and profile data are personal information, so enabling bulk access without safeguards creates a meaningful privacy and surveillance risk if used on someone else's session or endpoint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The instructions for viewing '共同群聊' expose relationship and group-membership information, which can reveal social graphs, affiliations, or other sensitive associations. In the context of a desktop automation skill, this is dangerous because it operationalizes collection of that data without any warning, purpose limitation, or consent check.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill documents an automated path to share a note to WeChat Moments, but it provides no warning, confirmation step, or constraint around external disclosure of the note contents. In a desktop automation skill, this is risky because automated keyboard navigation can publish private user data to a broader audience with little visibility or opportunity to stop the action.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The instructions direct the operator to copy WeChat videos and chat files from local storage to another destination without any warning about the sensitivity of chat data, consent requirements, or the risk of overwriting/exfiltrating personal files. In a desktop automation skill for messaging data, this omission materially increases the chance of privacy violations or unsafe bulk export of user content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill includes explicit steps to clear chat history and confirm deletion, but provides no warning that the action is destructive and potentially irreversible. In a desktop automation skill, this is risky because an agent or user could execute it quickly against the wrong chat, causing unintended data loss.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill gives step-by-step instructions to send text, files, audio, and mentions to WeChat recipients, but it does not require explicit user confirmation or warn that content will be transmitted to external parties. In an automation context, this increases the risk of accidental disclosure, misdelivery, or unintended exfiltration of sensitive data through a real messaging channel.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explains how to open and traverse chat history without warning that these records may contain sensitive personal or business information. Because the instructions support extraction and browsing of prior conversations, they can facilitate unauthorized access or disclosure if used on the wrong account, contact, or machine.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

These instructions provide a straightforward capability to enumerate and scroll through chat history, effectively enabling collection of sensitive conversation data at scale without any safeguards on authorization, minimization, or destination of the extracted data. In a desktop automation skill, that materially increases data-leak risk because the agent can operationalize access to messages beyond a narrowly scoped user action.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

These instructions automate creating and publishing a WeChat Moments post from the user's account without any warning, confirmation, or safety boundary around public/social posting. Because the action is externally visible and may publish arbitrary user-provided text, an agent using this skill could cause reputational harm, accidental disclosure, or unwanted posting on the user's behalf.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The liking/commenting flow performs visible social interactions from the user's account but provides no warning that these actions are public or attributable to the user. This creates risk of unauthorized engagement, impersonation of user intent, and accidental comments being posted to contacts if triggered by an agent without strong confirmation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The document explicitly guides users to search contacts, group chats, chat history, and favorites in WeChat, all of which can reveal private personal data on screen during automation. In a desktop automation skill, failing to warn about exposure through visible UI, logs, screenshots, or downstream snapshots increases the risk of unintended disclosure of sensitive user information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instruction to run a full UI snapshot while searching chat records can capture sensitive message previews, contact names, group names, and other personal identifiers present in the search results. Because this skill is specifically for desktop automation of a messaging app, snapshot output is especially likely to contain private data and may be retained in logs or artifacts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill provides direct UI automation steps to click '退出登录' and then confirm with '确定' without any warning, confirmation gating, or note that the action immediately signs the user out and can disrupt the current session. In a desktop automation skill, omission of such safety context is dangerous because an agent could execute these steps on behalf of a user and cause unintended session termination or workflow interruption.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file documents extracting a logged-in WeChat wxid from process memory mappings without any warning, consent requirement, or privacy boundary. That exposes sensitive account-linked data and can facilitate user identification, targeting, or unintended data collection, especially because the skill is meant for desktop automation rather than forensic inspection.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documentation includes a technique to inspect Weixin.exe memory mappings and derive the currently logged-in wxid, which is account-identifying information unrelated to basic desktop automation. Even though presented as an example and noted as not directly implementable via winguictl, it normalizes a privacy-invasive data access pattern that could be reused to enumerate user identities without clear consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The document explicitly positions WeChat desktop automation for direct agent execution, but it does not warn about privacy exposure, unintended message sending, account controls, or platform anti-abuse/account-risk consequences. In the context of a desktop automation skill, this omission is meaningful because the agent may act on a live personal messaging account and sensitive chat data, increasing the chance of harmful or non-consensual actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This documentation exposes clipboard read and write capabilities, including a get-text command that can retrieve arbitrary clipboard contents, but it provides no warning about sensitive data such as passwords, tokens, API keys, personal information, or copied files. In a desktop automation skill, clipboard access is especially risky because the clipboard often contains high-value transient secrets, and normalizing its use without safeguards can lead to accidental exfiltration or misuse by downstream agents or users.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.