weixin-xlog-analyzer

• Outcome: Pass
• Latest audit: May 28, 2026, 10:34 AM
• Version:
  1.0.0

Overview

This is a local WeChat log analysis skill with normal file read/write behavior and privacy precautions users should keep in mind.

Install only if you intend to analyze WeChat Xlog files locally. Use trusted external tools if decryption is needed, quote file paths when running commands, analyze only logs you are authorized to inspect, redact sensitive fields before sharing outputs, and store or delete generated JSON reports carefully.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill instructs the agent to read user-supplied log files and write parsed/analysis output files, but it does not explicitly declare those capabilities or constrain where reads and writes may occur. In an agent environment, undeclared file access increases the chance of overbroad filesystem access, accidental processing of unrelated local files, or writing sensitive derived data to unsafe locations.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: The trigger conditions are broad enough that the skill could be invoked for loosely related requests about logs, troubleshooting, or statistics without clear boundaries. That can cause unintended execution on the wrong files or contexts, increasing exposure to sensitive data and unnecessary file operations.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: WeChat logs can contain sensitive information such as account identifiers, device details, message metadata, tokens, or internal application state, yet the skill provides no warning about privacy risks. Without explicit notice and handling guidance, users may upload or process logs that expose personal or confidential data, and the generated reports may further propagate that information.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The document instructs users to decrypt and analyze WeChat Xlog files but does not warn that such logs can contain highly sensitive data such as user identifiers, message metadata, device details, network endpoints, or authentication-related information. In a log-analysis skill, this omission increases the chance that users will process, store, share, or expose private data without appropriate safeguards.

VirusTotal

66/66 vendors flagged this skill as clean.