wechat-chat-analysis

• Outcome: Review
• Latest audit: Aug 5, 2026 · 9:55 AM UTC
• Version: 1.0.1

Overview

This skill is a local WeChat relationship-analysis helper, but it stores and ships raw chat data, so it needs careful review before installation.

Review this before installing. Only use it if you are comfortable granting an agent access to local WeChat chats, contacts, recent sessions, unread status, and relationship-related message content. Delete the bundled data files before use, disable raw transcript output and caching if possible, and require explicit confirmation for each contact or session scan.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill invokes shell commands, reads local chat data, writes temporary and persistent files, and uses environment variables, yet declares no permissions. This creates a transparency and consent failure: an agent could access sensitive local WeChat conversations and write derived artifacts without an explicit permission boundary, making accidental overreach more likely.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared purpose suggests local chat analysis and reply assistance, but the documented behavior goes beyond that by scanning active conversations, retaining per-contact history, caching exports, storing feedback, and outputting raw chat logs. That mismatch is dangerous because users may authorize a narrow analysis use case while the skill performs broader surveillance and retention of highly sensitive interpersonal data.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The skill presents itself as local chat analysis, but it persists additional analysis state and user-derived data to local files such as history and cache artifacts. For sensitive relationship and chat content, this increases the attack surface and retention window, enabling later exposure through other local processes, backups, or shared-machine access.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The feedback-tracking feature stores user reactions to advice in a local file, which is not necessary for one-off chat analysis and expands the personal data collected about relationship decisions and preferences. Even if intended as product improvement, it creates additional profiling data that could be exposed or reused beyond the user's expectations.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The script says it builds a statistical report, but its default behavior includes the full raw chat transcript in the output file via --include-raw with default=True. In a skill designed to process intimate WeChat conversations, this creates a serious privacy leak because highly sensitive personal data is copied to disk even when the user may expect only derived analysis.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger description is broad enough to activate on common conversational requests, which can cause the skill to read or analyze private chat data in situations where the user did not intend to authorize local data access. Because the underlying data is highly sensitive, ambiguous invocation increases the risk of over-collection and surprise access.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: Realtime-mode activation includes subjective conditions like the agent deciding the user is 'currently chatting,' which invites discretionary access to recent messages without a clear, explicit user request. In a context involving intimate chat history, that ambiguity materially increases privacy risk and the chance of unauthorized inspection.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The multi-person scan can be invoked by broad phrases or by the agent's own judgment, enabling enumeration of active private conversations, unread messages, and recent activity across multiple contacts. This is especially sensitive because it reveals relationship metadata about many people, not just the user-selected analysis target, turning a helper skill into a contact-activity scanner.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The framework explicitly instructs exporting and analyzing local WeChat chat records, which are highly privacy-sensitive communications, but it provides no warning, minimization guidance, consent checks, retention limits, or handling safeguards. In the context of a romance/personality analysis skill, this increases the chance of unnecessary exposure of intimate third-party data and unsafe downstream use of locally extracted chat content.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script writes raw exported WeChat conversations to a report file on disk without an explicit privacy warning, consent gate, or secure handling controls. Because chat logs can contain sensitive relationship, financial, health, and identity information, silent local persistence materially increases exposure to other local users, backups, indexing services, and later unintended disclosure.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The code caches raw exported chat content in export_cache.json for 60 seconds without clear disclosure to the user. Even short-lived caching of intimate message content is risky in this skill context because it expands the number of places sensitive data is stored and may expose data to other local processes, users, or forensic recovery.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The script persists historical analysis snapshots and related records to local files without clear notice or retention controls. Although the stored snapshots are less sensitive than full transcripts, they still reveal communication patterns and behavioral summaries that can be private in a relationship-analysis tool.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: Persisting chat-analysis snapshots, caches, and feedback history for sensitive conversation analysis creates a data retention risk: intimate content and derived relationship inferences may remain on disk longer than needed and leak through backups, malware, shared accounts, or later tooling access. The context makes this more dangerous because the source material is private social communication and the derived insights can be even more sensitive than the raw text.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.