T09 · Insecure Skill Coding Practices
Error
- Location
tool/wechat_cli/core/db_cache.py:27- Finding
Predictable Shared Cache Directory Enables Privileged File Overwrite and Deletion
- Content
View full analysis
- Remediation
View remediation
Security audit
wechat-local-reader
Security checks for vulnerabilities and agentic risk
Overview
This skill is a local WeChat reader, but it uses invasive key extraction and privilege-changing workflows that users should review carefully before installing.
Install only if you intentionally want an agent/tool to extract keys from your running desktop WeChat process and read local messages. Avoid shared machines, avoid granting CAP_SYS_PTRACE to the system python3 interpreter, prefer HTTPS-only destinations, and clean or remove ~/.wechat-cli and the temp cache when finished.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (6)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
tool/wechat_cli/keys/scanner_linux.py:105- Finding
Guidance Grants CAP_SYS_PTRACE to the Shared Python Interpreter
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
tool/wechat_cli/keys/scanner_macos.py:17- Finding
Unverified Externally Obtained macOS Helper Is Executed with Sensitive Privileges
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
tool/pyproject.toml:1- Finding
Mutable Unhashed Python Dependencies Allow Installation-Time Supply-Chain Compromise
- Content
View full analysis
=68.0", "wheel"] build-backend = "setuptools.build_meta" [project] name = "wechat-cli" version = "0.2.4" description = "WeChat data query CLI for LLMs" requires-python = ">=3.10" dependencies = [ "click>=8.1,<9", "pycryptodome>=3.19,<4", "zstandard>=0.22,<1", ] ``` Related installation behavior in `tool/setup.sh:11-13`: ```bash .venv/bin/python -m pip install --upgrade pip -q .venv/bin/python -m pip install -e . -q ``` ### Technical Analysis The project permits broad future dependency versions and does not provide a hash-locked dependency set. The installer also upgrades pip and resolves dependencies from configured package indexes at installation time. Python package installation may execute package-controlled build backends or installation hooks. Therefore, a future compromised release that still falls within an allowed version range can execute code during setup even if the reviewed Skill source remains unchanged. No dependency confusion or malicious package was confirmed in the audited snapshot. The issue is the absence of reproducible, integrity-checked dependency resolution. ### Attack Path 1. An allowed package version or its distribution account is compromised. 2. A malicious release is published within one of the permitted ranges. 3. A user runs `setup.sh` or `setup.ps1`. 4. Pip resolves the new release because no exact lock or hash is enforced. 5. The package's build or installation logic executes inside the user's environment. 6. The malicious dependency gains the invoking user's privileges and may access local files, WeChat data, and stored database keys. ### Impact Assessment Successful exploitation provides code execution during installation with the privileges of the user running s ...[truncated 203 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:225- Finding
Documentation Encourages Transmission of WeChat-Derived Reports over Plaintext HTTP
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
tool/wechat_cli/keys/scanner_macos.py:72- Finding
Optional Re-Signing Adds Debug Entitlement and Weakens WeChat Process Protections
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (99)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The Windows-specific behavior includes scanning another process’s memory regions through OS APIs to recover encryption keys, yet this invasive capability is not reflected in the top-level purpose statement. In context, this is particularly sensitive because it transforms the skill into a memory-inspection/key-recovery tool for a consumer messaging app.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The Windows-specific behavior includes scanning another process’s memory regions through OS APIs to recover encryption keys, yet this invasive capability is not reflected in the top-level purpose statement. In context, this is particularly sensitive because it transforms the skill into a memory-inspection/key-recovery tool for a consumer messaging app.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The Windows-specific behavior includes scanning another process’s memory regions through OS APIs to recover encryption keys, yet this invasive capability is not reflected in the top-level purpose statement. In context, this is particularly sensitive because it transforms the skill into a memory-inspection/key-recovery tool for a consumer messaging app.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The Windows-specific behavior includes scanning another process’s memory regions through OS APIs to recover encryption keys, yet this invasive capability is not reflected in the top-level purpose statement. In context, this is particularly sensitive because it transforms the skill into a memory-inspection/key-recovery tool for a consumer messaging app.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The Windows-specific behavior includes scanning another process’s memory regions through OS APIs to recover encryption keys, yet this invasive capability is not reflected in the top-level purpose statement. In context, this is particularly sensitive because it transforms the skill into a memory-inspection/key-recovery tool for a consumer messaging app.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The Windows-specific behavior includes scanning another process’s memory regions through OS APIs to recover encryption keys, yet this invasive capability is not reflected in the top-level purpose statement. In context, this is particularly sensitive because it transforms the skill into a memory-inspection/key-recovery tool for a consumer messaging app.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The Windows-specific behavior includes scanning another process’s memory regions through OS APIs to recover encryption keys, yet this invasive capability is not reflected in the top-level purpose statement. In context, this is particularly sensitive because it transforms the skill into a memory-inspection/key-recovery tool for a consumer messaging app.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The Windows-specific behavior includes scanning another process’s memory regions through OS APIs to recover encryption keys, yet this invasive capability is not reflected in the top-level purpose statement. In context, this is particularly sensitive because it transforms the skill into a memory-inspection/key-recovery tool for a consumer messaging app.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The Windows-specific behavior includes scanning another process’s memory regions through OS APIs to recover encryption keys, yet this invasive capability is not reflected in the top-level purpose statement. In context, this is particularly sensitive because it transforms the skill into a memory-inspection/key-recovery tool for a consumer messaging app.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The Windows-specific behavior includes scanning another process’s memory regions through OS APIs to recover encryption keys, yet this invasive capability is not reflected in the top-level purpose statement. In context, this is particularly sensitive because it transforms the skill into a memory-inspection/key-recovery tool for a consumer messaging app.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The Windows-specific behavior includes scanning another process’s memory regions through OS APIs to recover encryption keys, yet this invasive capability is not reflected in the top-level purpose statement. In context, this is particularly sensitive because it transforms the skill into a memory-inspection/key-recovery tool for a consumer messaging app.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The Windows-specific behavior includes scanning another process’s memory regions through OS APIs to recover encryption keys, yet this invasive capability is not reflected in the top-level purpose statement. In context, this is particularly sensitive because it transforms the skill into a memory-inspection/key-recovery tool for a consumer messaging app.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The Windows-specific behavior includes scanning another process’s memory regions through OS APIs to recover encryption keys, yet this invasive capability is not reflected in the top-level purpose statement. In context, this is particularly sensitive because it transforms the skill into a memory-inspection/key-recovery tool for a consumer messaging app.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The Windows-specific behavior includes scanning another process’s memory regions through OS APIs to recover encryption keys, yet this invasive capability is not reflected in the top-level purpose statement. In context, this is particularly sensitive because it transforms the skill into a memory-inspection/key-recovery tool for a consumer messaging app.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The Windows-specific behavior includes scanning another process’s memory regions through OS APIs to recover encryption keys, yet this invasive capability is not reflected in the top-level purpose statement. In context, this is particularly sensitive because it transforms the skill into a memory-inspection/key-recovery tool for a consumer messaging app.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The Windows-specific behavior includes scanning another process’s memory regions through OS APIs to recover encryption keys, yet this invasive capability is not reflected in the top-level purpose statement. In context, this is particularly sensitive because it transforms the skill into a memory-inspection/key-recovery tool for a consumer messaging app.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The documentation instructs users to re-sign the WeChat application with the com.apple.security.get-task-allow entitlement so the tool can inspect process memory and extract encryption keys. This is a powerful host modification that weakens platform protections, modifies a third-party app binary, and enables access to highly sensitive private message databases far beyond what a simple summarization skill should require.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The re-signing instructions tell the user to run privileged commands that modify /Applications/WeChat.app and grant debugging-style process inspection capability, but the warning language downplays the seriousness by calling it safe and minimizing consequences. In a hostile or careless deployment, this can normalize weakening macOS security controls and exposing private communications to any component able to leverage the modified app context.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The disclaimer claims the tool is read-only and does not interfere with WeChat, but earlier instructions require re-signing the WeChat app and persisting extracted keys or plaintext cache on disk. Those actions materially alter the local environment and create new sensitive artifacts, so the safety claims are misleading and may cause users or agents to underestimate the risk.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This code scans process memory for candidate key material and validates it against database pages, effectively extracting live decryption keys from a running WeChat process. That is a credential-harvesting capability, not a normal summarization/desensitization function, and it creates a powerful primitive for unauthorized access to protected message databases on the host.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The code writes raw WeChat database decryption keys to a JSON file on disk, which materially increases exposure of highly sensitive credentials beyond transient local use. Even with chmod(0o600), plaintext key persistence enables later theft by malware, backups, other local admin users, or accidental disclosure, and it exceeds the manifest’s user-facing description of merely reading/desensitizing messages for summaries.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The file enumerates /proc, identifies candidate WeChat processes, parses memory maps, and prepares broad readable-region scanning. In a summarization/desensitization skill, this is disproportionate capability: it creates a generic process-inspection primitive that can expose secrets from process memory and normalizes invasive host introspection.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The code explicitly requires root or CAP_SYS_PTRACE and then reads another process's memory to recover WeChat database keys. That is a powerful credential-extraction capability beyond ordinary local file access, and in the skill context it materially increases the risk of unauthorized surveillance, privilege misuse, and compromise of private communications if invoked on the wrong host or user session.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The extraction flow proceeds to scan live process memory and derive keys without a clear, explicit warning at the point of action about the privacy and security implications. In this skill's context, the lack of a strong warning is more dangerous because the advertised purpose emphasizes privacy and local-only handling, which could mislead users about how invasive the implementation actually is.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Adding
com.apple.security.get-task-allowspecifically enables debugging-style access that facilitates process-memory inspection, which is not justified by the stated purpose of summarizing a user's own local WeChat messages. In this skill context, that capability is especially dangerous because it is used to recover encryption keys from a live process, bypassing normal access boundaries.- Content
Static analysis
No suspicious patterns detected.