wecom-gui-message

• Outcome: Review
• Latest audit: May 29, 2026 · 9:35 PM UTC
• Version: 3.0.1

Overview

This skill matches its stated WeCom automation purpose, but it needs Review because it can send real business messages and has an unsafe command execution path.

Review carefully before installing. Use only with explicit trusted recipient and message text, do not pass untrusted or generated content until shell command construction is fixed, test in a harmless chat first, and clear /tmp/wecom-gui after use or add automatic screenshot cleanup.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def run(cmd, timeout=15):
    log(f"→ {cmd[:120]}")
    result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=timeout)
    if result.returncode != 0 and result.stderr:
        log(f"  stderr: {result.stderr[:200]}")
    return result

• Confidence: 98% confidence
• Finding: result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=timeout)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill describes shell-capable GUI automation over a desktop messaging client but does not declare any permissions, which hides the true trust boundary from users and policy enforcement. In this context, shell access combined with Screen Recording and Accessibility-enabled tooling can drive arbitrary desktop actions and interact with sensitive chats, making undeclared capability exposure materially risky.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: The trigger phrases are broad natural-language variants such as 'wecom message' and '给某人发企微消息', without narrowing who can be messaged, what content is allowed, or whether user confirmation is required. Because this skill automates sending messages through a real enterprise chat client, overbroad invocation increases the chance of accidental or socially engineered activation that sends unintended messages to contacts or groups.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill requires Screen Recording and Accessibility, which are highly privacy-sensitive macOS permissions that allow observing on-screen content and controlling user input across applications, yet the description does not prominently warn users about these risks. In a desktop messaging automation skill, this omission is especially dangerous because the tool can access chat contents, contacts, and other visible information and can act on the user's behalf.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.