Security audit

weixin-xlog-analyzer

Security checks for vulnerabilities and agentic risk

Overview

This skill locally parses user-provided WeChat Xlog files and writes JSON analysis reports, with no evidence of hidden network access, persistence, privilege escalation, or destructive behavior.

Install only if you intend to analyze WeChat Xlog files locally. Treat decrypted logs and generated JSON reports as potentially sensitive because they may include account, device, network, chat, payment, or diagnostic details; redact or limit them before sharing and choose output paths deliberately.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: 代码与“解析微信Xlog日志文件、提取关键信息、统计日志数据”这部分描述基本一致，也没有发现额外的敏感或未声明能力；它只进行本地文件读取、正则解析、过滤和JSON输出。但声明中特别提到“生成诊断报告”以及更广义的“分析、排查故障”，而实际代码并未做诊断结论、异常模式识别、故障定位或报告生成，只提供结构化解析和基础汇总统计。因此存在轻度到中度的描述-行为不一致：声明比实际能力更强。

Lp3

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill instructs reading input log files and writing parsed/analysis outputs, but it does not declare any explicit tool scope such as permissions or allowed-tools. Missing scope boundaries can let an agent invoke broader file capabilities than intended, increasing the chance of unauthorized file access or writes when handling user-supplied paths.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: 描述中写明“当用户需要分析微信日志、排查故障或统计日志数据时使用”，其中“排查故障”范围较大，缺少对必须是微信Xlog日志场景的更强约束。虽然前文提到微信Xlog，但该触发描述本身没有列出明确触发短语、边界或排除条件，容易在一般性故障排查语境中被误匹配。

Vague Triggers

Medium

Confidence: 94% confidence
Finding: 该行使用“用户需要分析微信日志、排查故障、统计日志数据或定位问题时”作为触发条件，其中“定位问题”与“排查故障”都属于常见宽泛表述。文档没有提供精确触发短语、上下文限制或负面示例，因此边界不清晰，可能导致超出预期的调用。

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill handles WeChat log files, which may contain sensitive personal, device, account, or operational information, yet it provides no privacy warning or data-handling guidance. This increases the risk that users upload, store, or process sensitive logs without informed consent, redaction, or minimization, potentially exposing private information.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The document explains how to parse and analyze WeChat Xlog files, which can contain sensitive user, device, network, and application activity data, but it provides no privacy, access-control, redaction, or retention guidance. In the context of a log-analysis skill, this omission increases the chance that operators will ingest, expose, or retain personal or confidential data without safeguards.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: This code file contains natural-language instructions, descriptions, and help text that force a specific language/locale for users. Under the policy, locale constraints should either be optional via user choice or clearly justified; neither is present here.

Natural-Language Policy Violations

Low

Confidence: 94% confidence
Finding: This code file contains natural-language documentation and CLI help text entirely in Chinese, presenting a fixed language choice to users. The file does not state that the tool is intended only for a Chinese-speaking or region-specific audience, nor does it offer an alternative locale.

Static analysis

No suspicious patterns detected.