WeChat Contact List Video Extraction & CRM Analyzer

• Outcome: Review
• Latest audit: Aug 17, 2026 · 12:16 PM UTC
• Version: 0.1.0

Overview

This skill is user-directed and mostly local, but it is designed to bulk extract private WeChat contact data into durable CRM files while understating privacy risk and user-control requirements.

Install only if you have authority to process the contacts shown in the recording. Treat every output file and cached frame as sensitive personal data, store them securely, delete temporary frames when finished, and avoid sharing or importing the exports into CRM systems without consent or a lawful basis. Review the Swift helper before running because the Python script compiles and executes it locally.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if not os.path.exists(ocr_bin) and os.path.exists(swift_src):
        print("🔨 编译高并发 Apple Vision OCR 引擎 (8 线程)...")
        subprocess.run(["swiftc", "-O", "-whole-module-optimization", swift_src, "-o", ocr_bin], check=True)
        
    print(f"\n🔍 正在通过 Apple Vision 引擎进行高精 OCR 与多帧去重分析...")
    t0 = time.time()

• Confidence: 88% confidence
• Finding: The script will compile and then later execute a local Swift source file (`mac_ocr_fast.swift`) if the binary is missing, effectively treating adjacent source code as trusted code. In an untrusted skill/package context, a modified Swift file can lead to arbitrary code execution when the user runs this script, and the security risk is amplified because the skill is explicitly designed to process sensitive contact data.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

for i in range(0, len(frames), chunk_size):
        chunk = frames[i:i+chunk_size]
        proc = subprocess.run([ocr_bin] + chunk, capture_output=True, text=True, check=True)
        for line in proc.stdout.splitlines():
            line = line.strip()
            if not line:

• Confidence: 91% confidence
• Finding: This code executes a locally built binary (`ocr_bin`) on a batch of frame paths without verifying the binary's integrity or provenance. Because the binary may have been compiled from an untrusted local Swift file, this becomes an arbitrary code execution sink; additionally, the tool is fed sensitive screenshots of contact data, increasing confidentiality impact if the helper binary is malicious.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill advertises 'zero-risk' and 'permission-free' behavior while providing shell-based processing steps that read videos and write extracted contact datasets and dashboards, yet it declares no permissions. This mismatch can mislead users and reviewers about the skill's real capabilities and data-handling behavior, especially because it processes sensitive personal contact information at scale.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The docstring asserts 'Zero PII' even though the script parses contact names, roles, organizations, cities, timestamps, and raw remarks, then exports them to JSON/CSV/HTML. This is dangerous because it misrepresents the data sensitivity and can cause users or downstream agents to handle personal data without appropriate consent, retention, or disclosure controls.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The description promotes bulk extraction of personal WeChat contacts into CRM assets without any privacy warning, consent guidance, or notice that the data may include third-party personal information. In this context, omission of warnings is dangerous because the skill is explicitly designed to convert a private contact list into structured, exportable datasets and dashboards.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The execution steps instruct users to record, extract, structure, and export an entire private contact list, but they provide no warning about the sensitivity of the data or the risks of creating CSV, JSON, and HTML outputs containing personal information. This materially increases the chance of accidental privacy violations, unauthorized retention, or onward sharing of bulk personal data.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script emits OCR-extracted contact text directly to stdout as JSON, which can expose highly sensitive personal data to terminals, logs, parent processes, shell history capture tools, or downstream pipelines without any consent, minimization, or redaction. In the context of a tool explicitly designed to extract WeChat personal contacts into CRM artifacts, this behavior materially increases privacy and data-exfiltration risk rather than being incidental debug output.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The script extracts WeChat contacts from screen recordings and writes the deduplicated results to disk automatically, but it provides no explicit privacy warning, consent checkpoint, retention control, or output protection. In this skill context, the processed data is inherently sensitive personal contact information, so silent persistence materially increases privacy and compliance risk.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script processes sensitive contact remarks and exports them into multiple durable formats without any warning, consent check, redaction option, or privacy-preserving defaults. In the context of a WeChat contact-to-CRM workflow, this increases the risk of unauthorized profiling, bulk disclosure, and accidental redistribution of personal relationship data.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The skill is explicitly framed as a method for mass extraction and assetization of private WeChat contact data into CRM records and dashboards, which goes beyond normal personal productivity and into systematic harvesting of third-party information. The surrounding claims of 'zero-risk' and 'permission-free' make the content more dangerous by normalizing and encouraging covert or policy-evasive collection behavior.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The guidance specifically encourages recording the full A-to-Z contact list and building a near-complete offline backup/archive, which materially enables bulk exfiltration and long-term retention of private contact data outside the original platform. In this context, the workflow is more dangerous because it is optimized for coverage, deduplication, and durable export rather than incidental personal use.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.