ClawHub
Back to skill

Security audit

Wechat Claude Code Installer

Security checks across malware telemetry and agentic risk

Overview

This is a clearly disclosed installer for a WeChat-to-Claude Code bridge, but the bridge is powerful and should only be used with a trusted or test WeChat account.

Install only if you intentionally want a persistent WeChat bridge that can cause your local Claude Code to read files, write files, and run commands. Use a test WeChat account, do not share the bound account, review the upstream repository before installing, avoid routing private chats through a company proxy, and avoid storing long-lived API tokens in LaunchAgent plists unless you understand the local exposure risk.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (20)

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill describes cloning an external repository, running shell commands, installing packages, and modifying local files and launchd configuration, yet it declares no permissions. That mismatch is dangerous because users or orchestrators may treat it as low-privilege while it actually performs privileged local actions including persistence and code execution.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The README advertises very broad natural-language trigger phrases such as '装一下微信桥' and '微信里用 Claude Code', which increases the chance the skill is invoked unintentionally during ordinary conversation. In a skill that installs and configures a message/file bridge, accidental invocation can lead to unwanted setup actions, privacy-affecting guidance, or users consenting to risky steps without clear intent.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The usage description promotes a WeChat-to-Claude bridge but does not prominently warn users that message contents and transferred files may be exposed to third-party services, logs, or unintended recipients. Because this skill explicitly configures bidirectional message/file bridging and even mentions proxy compliance concerns, omitting a privacy warning materially increases the risk of sensitive data disclosure.

Vague Triggers

Medium
Confidence
80% confidence
Finding
The metadata description includes broad natural-language trigger phrases such as requests to 'install the WeChat bridge' or 'configure it per that article,' which can match normal conversation. Ambiguous triggers increase the chance of unintended activation of a skill that performs shell operations, installs third-party code, and changes persistence settings.

Vague Triggers

Medium
Confidence
86% confidence
Finding
The trigger section lists multiple colloquial invocation examples without strict boundaries, making accidental activation plausible. In this skill's context, unintended activation is more serious because the documented workflow includes cloning code, running npm install, and modifying launchd/session state on the host.

Session Persistence

Medium
Category
Rogue Agent
Content
|---|---|
| `fix-cwd.sh "$HOME/Claude Code"` | 坑 1：直接改 session.json |
| `fix-meta-talk.sh ["自定义 prompt"]` | 坑 2：覆盖 systemPrompt |
| `fix-caffeinate.sh` | 坑 3：plist 加 `caffeinate -i` |

### 第 4 步：起 daemon + 验证
Confidence
82% confidence
Finding
plist

Session Persistence

Medium
Category
Rogue Agent
Content
cd ~/.claude/skills/wechat-claude-code && npm run daemon -- stop

# 永久关（重启后也不起；修第 5 个坑）
launchctl unload -w ~/Library/LaunchAgents/com.wechat-claude-code.bridge.plist

# 重新启用
launchctl load -w ~/Library/LaunchAgents/com.wechat-claude-code.bridge.plist
Confidence
76% confidence
Finding
plist

Session Persistence

Medium
Category
Rogue Agent
Content
launchctl unload -w ~/Library/LaunchAgents/com.wechat-claude-code.bridge.plist

# 重新启用
launchctl load -w ~/Library/LaunchAgents/com.wechat-claude-code.bridge.plist
```

## 上游漂移检测（v0.3 新增）
Confidence
80% confidence
Finding
launchctl load

Session Persistence

Medium
Category
Rogue Agent
Content
launchctl unload -w ~/Library/LaunchAgents/com.wechat-claude-code.bridge.plist

# 重新启用
launchctl load -w ~/Library/LaunchAgents/com.wechat-claude-code.bridge.plist
```

## 上游漂移检测（v0.3 新增）
Confidence
80% confidence
Finding
plist

Session Persistence

Medium
Category
Rogue Agent
Content
如果 doctor 报告 `ANTHROPIC_BASE_URL` 指向公司代理，且不希望微信对话经过公司日志：

```bash
PLIST=~/Library/LaunchAgents/com.wechat-claude-code.bridge.plist
python3 <<'PY'
import plistlib, os
p = os.path.expanduser("~/Library/LaunchAgents/com.wechat-claude-code.bridge.plist")
Confidence
83% confidence
Finding
PLIST

Session Persistence

Medium
Category
Rogue Agent
Content
如果 doctor 报告 `ANTHROPIC_BASE_URL` 指向公司代理，且不希望微信对话经过公司日志：

```bash
PLIST=~/Library/LaunchAgents/com.wechat-claude-code.bridge.plist
python3 <<'PY'
import plistlib, os
p = os.path.expanduser("~/Library/LaunchAgents/com.wechat-claude-code.bridge.plist")
Confidence
83% confidence
Finding
plist

Session Persistence

Medium
Category
Rogue Agent
Content
```bash
PLIST=~/Library/LaunchAgents/com.wechat-claude-code.bridge.plist
python3 <<'PY'
import plistlib, os
p = os.path.expanduser("~/Library/LaunchAgents/com.wechat-claude-code.bridge.plist")
with open(p, 'rb') as f: d = plistlib.load(f)
env = d.setdefault('EnvironmentVariables', {})
Confidence
85% confidence
Finding
plist

Session Persistence

Medium
Category
Rogue Agent
Content
PLIST=~/Library/LaunchAgents/com.wechat-claude-code.bridge.plist
python3 <<'PY'
import plistlib, os
p = os.path.expanduser("~/Library/LaunchAgents/com.wechat-claude-code.bridge.plist")
with open(p, 'rb') as f: d = plistlib.load(f)
env = d.setdefault('EnvironmentVariables', {})
env['ANTHROPIC_AUTH_TOKEN'] = 'sk-ant-api03-你的key'
Confidence
90% confidence
Finding
plist

Session Persistence

Medium
Category
Rogue Agent
Content
python3 <<'PY'
import plistlib, os
p = os.path.expanduser("~/Library/LaunchAgents/com.wechat-claude-code.bridge.plist")
with open(p, 'rb') as f: d = plistlib.load(f)
env = d.setdefault('EnvironmentVariables', {})
env['ANTHROPIC_AUTH_TOKEN'] = 'sk-ant-api03-你的key'
env['ANTHROPIC_BASE_URL'] = 'https://api.anthropic.com/v1/'
Confidence
82% confidence
Finding
plist

Session Persistence

Medium
Category
Rogue Agent
Content
env = d.setdefault('EnvironmentVariables', {})
env['ANTHROPIC_AUTH_TOKEN'] = 'sk-ant-api03-你的key'
env['ANTHROPIC_BASE_URL'] = 'https://api.anthropic.com/v1/'
with open(p, 'wb') as f: plistlib.dump(d, f)
print("done")
PY
launchctl unload ~/Library/LaunchAgents/com.wechat-claude-code.bridge.plist
Confidence
85% confidence
Finding
plist

Session Persistence

Medium
Category
Rogue Agent
Content
with open(p, 'wb') as f: plistlib.dump(d, f)
print("done")
PY
launchctl unload ~/Library/LaunchAgents/com.wechat-claude-code.bridge.plist
launchctl load ~/Library/LaunchAgents/com.wechat-claude-code.bridge.plist
```
Confidence
82% confidence
Finding
plist

Session Persistence

Medium
Category
Rogue Agent
Content
print("done")
PY
launchctl unload ~/Library/LaunchAgents/com.wechat-claude-code.bridge.plist
launchctl load ~/Library/LaunchAgents/com.wechat-claude-code.bridge.plist
```

## 卸载
Confidence
80% confidence
Finding
launchctl load

Session Persistence

Medium
Category
Rogue Agent
Content
print("done")
PY
launchctl unload ~/Library/LaunchAgents/com.wechat-claude-code.bridge.plist
launchctl load ~/Library/LaunchAgents/com.wechat-claude-code.bridge.plist
```

## 卸载
Confidence
80% confidence
Finding
plist

Tool Parameter Abuse

High
Category
Tool Misuse
Content
if [ -d ~/.claude/skills/wechat-claude-code ]; then
  echo "→ 删除上游项目..."
  rm -rf ~/.claude/skills/wechat-claude-code
fi

if [ -d ~/.wechat-claude-code ]; then
Confidence
78% confidence
Finding
rm -rf ~/.claude/skills/

Tool Parameter Abuse

High
Category
Tool Misuse
Content
if [ -d ~/.wechat-claude-code ]; then
  echo "→ 删除数据目录..."
  rm -rf ~/.wechat-claude-code
fi

echo ""
Confidence
85% confidence
Finding
rm -rf ~/

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.