Security audit

Pyweixin Rpa

Security checks across malware telemetry and agentic risk

Overview

This is a real WeChat automation skill, but it exposes powerful account-changing and data-access actions without enough built-in safeguards.

Install only if you intentionally want broad control over a logged-in Windows WeChat client. Before use, restrict agents to explicit user-requested actions, require confirmation before sending, posting, accepting contacts, joining groups, clearing history, changing settings, or running scheduled tasks, and treat exported chats, contacts, QR codes, local WeChat paths, files, and media as sensitive private data.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (31)

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The reference documents capabilities well beyond the skill's declared scope, including monitoring, calls, system settings, and other higher-risk account actions. Scope expansion is dangerous because downstream agents may rely on the richer API surface instead of the manifest, enabling actions the user did not reasonably expect from a WeChat messaging/files/Moments/contact automation skill.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The file exposes Windows system-level settings functionality unrelated to normal WeChat automation, increasing the blast radius from app automation to host-level manipulation. Even though signatures are not fully documented here, advertising system-setting hooks invites use of broader privileged operations than users would expect from this skill.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: Voice and video calling are active social actions that can contact other people in real time and are not disclosed in the manifest description. This mismatch matters because calls are more intrusive than passive messaging/document handling and can create reputational, privacy, or harassment risk if triggered unexpectedly.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The documented settings APIs can alter account behavior and client configuration, such as language, notifications, style, font size, and auto-download behavior, beyond the manifest's stated purpose. Configuration-changing operations are dangerous because they persist beyond the task, can degrade usability or privacy, and may be hard for users to notice or undo.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The module header and stated skill scope underrepresent the code's actual capabilities. Beyond messages/files/Moments/contacts, the file includes account logout, friend verification and blocking, privacy changes, chat deletion, and automatic group joining, which materially changes the trust and risk profile of the skill.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The code can automatically scan chat history for invitation links and join groups without an interactive approval step. That enables unauthorized account state changes and can be abused to mass-enroll the user's account into unwanted or malicious groups, increasing exposure to spam, scams, and reputation damage.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: This section automates adding friends, accepting requests, blocking/unblocking contacts, changing privacy, and editing remarks/phone metadata. Those are sensitive account and relationship-management actions outside the declared skill purpose, and they can silently alter a user's social graph and trust boundaries.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The skill can log out the currently signed-in WeChat account, which is unrelated to the advertised automation scope and can disrupt user access. In an agent setting, this is a destructive account-state change that can deny service and interfere with subsequent automation or user activity.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The module goes beyond ordinary UI automation by discovering the logged-in WeChat account identifier and local storage directories, including chat/message database locations. It does this by inspecting process metadata and memory-mapped files, which exposes sensitive local account context and materially increases the ability to locate and access private user data.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The skill can capture the WeChat login window and save the QR code image to an arbitrary local path. That enables unattended handling of login artifacts and local file creation not disclosed by the manifest, which can expose authentication material or facilitate unauthorized session establishment if misused.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: The code can search for and automatically subscribe to official accounts, which is an account-modifying action rather than simple navigation or message automation. Even if intended as convenience automation, it can silently alter a user's subscriptions and content exposure without clear disclosure.

Context-Inappropriate Capability

Medium

Confidence: 87% confidence
Finding: The code can change system audio state and prevent the display from sleeping, which are host-level side effects unrelated to core message automation. In an agent skill context, these actions can degrade user privacy and device safety expectations, and could be abused to keep a machine active or alter audio behavior without clear consent.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: This skill is designed to automate sending messages/files and retrieving or exporting WeChat chats, contacts, and related data, but the documentation does not prominently warn about privacy, consent, and irreversible data-impact risks. In a messaging/RPA context, that omission is dangerous because the tool operates on sensitive personal communications and can exfiltrate or alter data at scale through UI automation.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The document explains how to use Windows Narrator/accessibility exposure to reveal and automate otherwise hidden WeChat UI structures, but it does so without clear warnings about account sanctions, privacy exposure, consent, or platform-policy risk. In the context of a skill explicitly intended for WeChat RPA, this guidance lowers the barrier to bypassing anti-automation protections and can enable bulk messaging, contact scraping, or other abusive actions against user expectations and platform controls.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The API documents bulk extraction of chat history, including sender, content, type, and timestamps, without any privacy warning, consent guardrail, or data-minimization guidance. In this context, the skill automates access to highly sensitive private communications, so undocumented extraction features materially increase surveillance and data exfiltration risk.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The document exposes methods for broad collection of friend details and profile information, potentially including identifiers and contact data, without warning that this is personal data. In a messaging automation skill, bulk contact harvesting is particularly sensitive because it enables profiling, social graph mapping, and downstream misuse of personal information.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: Automatically approving new friend requests performs a consequential social/account action with limited user visibility and no warning about impersonation, spam, or account-integrity risks. This can expand an attacker's reach into the user's network or cause the account to accept unwanted or malicious contacts automatically.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The API documents clearing chat history without an explicit irreversibility warning or safety confirmation, which creates a serious risk of destructive data loss. In the WeChat context, chat history may contain business records, personal evidence, or irreplaceable information, so a single mistaken invocation can cause substantial harm.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The monitoring APIs support continuous listening, auto-saving files/media, and collection of new message content without any warning about surveillance, consent, or secure storage. In a private messaging environment, these capabilities are especially sensitive because they enable ongoing capture of personal communications and attachments beyond normal user awareness.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The Moments publishing APIs can post content from the user's account without prominently warning that the result is outward-facing social content. This is risky because unintended posts can create privacy leaks, reputational damage, or disclosure of sensitive media to the user's social audience.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The function clears chat history immediately after navigating to the control and clicking the confirm button, without any additional user-facing warning or safety interlock in the skill. Because chat deletion is destructive and may be irreversible from the client UI, accidental or indirect invocation can cause permanent data loss.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The code can auto-approve incoming friend requests when `verify=True`, changing the account's contact list without a direct confirmation at execution time. This weakens user control over trust relationships and can expose the account to unwanted contact, spam, or social-engineering risk.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The group invitation handler attempts to join groups automatically from matching links in chat history and does not require interactive confirmation for each join. This creates a direct path for account state changes triggered by passive message content rather than an explicit user action.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: The skill can forcibly change the client language and even notes that further automation may require manual login afterward. This is a disruptive state-changing action that can confuse users, break expected UI assumptions, and effectively act as a denial-of-service for ongoing automation without strong opt-in.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: These helpers expose installation and local data paths and can copy them to the clipboard or open them in Explorer without any warning or consent flow. Such paths can reveal account context and provide direct access to private chat-related files, increasing the risk of data harvesting or accidental disclosure.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.