Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- scripts/extract.js:173
Security audit
wechat-to-ima
Security checks for vulnerabilities and agentic risk
Overview
The skill does what it claims, but its extractor executes JavaScript taken from fetched WeChat pages, which is risky enough to require careful review before installation.
Review this skill carefully before installing. Its IMA credential use and note/knowledge-base creation are expected, but the JavaScript extractor should ideally be fixed to avoid executing code from fetched WeChat pages. If you still use it, run it in a sandbox and with limited IMA credentials.
Static analysis
Detected: suspicious.dynamic_code_execution