wecom-gui-message

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:11 AM UTC
• Version: 3.0.1

Overview

This skill is a real WeCom message automation tool, but it has unsafe command execution and message-sending safeguards that users should review before installing.

Install only if you are comfortable granting desktop control and screen-capture capabilities to a script that can send live WeCom messages. Review or fix the shell command construction, require recipient confirmation before sending, avoid full-screen capture, and clean up temporary screenshots before using it with sensitive chats or work data.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/send_message.py:48

Finding

Arbitrary Shell Command Injection Through Recipient and Message Inputs

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/send_message.py:331

Finding

Ambiguous OCR Matching Can Send Messages to the Wrong Recipient

Content

View full analysis

= 2: target = ocr_find(img, name[:2]) if target: log(f" ✓ 找到 '{target['text']}'") click_ocr_target(win, target) time.sleep(2) # 验证：右侧聊天区是否有内容 img2, _ = screenshot("after_click.png") ocr_result = ocr(img2) if ocr_result and ocr_result.get("success"): right_texts = [t for t in ocr_result.get("all_texts", []) if t["center_x"] > 800] if len(right_texts) > 3: log(f" ✓ 聊天窗口已打开（右侧 {len(right_texts)} 元素）") return True ``` ```python # 发送 log("按回车发送...") press_key("return") time.sleep(2) # 验证发送 img, _ = screenshot("sent_verify.png") target = ocr_find(img, check_text) if target: log(" ✅ 消息已在聊天记录中确认") else: log(" ⚠ 未在聊天记录确认（回车已按，大概率已发送）") return True ``` ### Technical Analysis The OCR implementation uses substring matching, and recipient selection falls back to the first two characters of the requested name. Two-character prefixes are commonly non-unique. If several contacts or groups share the same prefix, the first OCR result can be selected without determining whether it represents the intended recipient. After clicking the result, the code only verifies that more than three OCR elements appear in the right side of the window. This confirms that some chat pane is open, but it does not confirm the selected conversation's identity. The sending routine then presses Return and reports success even when post-send OCR cannot confirm the message. These fail-open behaviors combine to cr ...[truncated 1069 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/send_message.py:121

Finding

Full-Screen Capture Collects Data Outside the WeCom Task Scope

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/send_message.py:27

Finding

Sensitive Screenshots Are Retained in a Predictable Shared Temporary Directory

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (8)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

This is a concrete tool-parameter abuse issue: shell command construction is centralized in run(), and multiple higher-level functions feed it attacker-influenced parameters. Inputs like args.message flow into paste_text(), args.name can influence OCR search commands, and OCR-detected text is also reused in shell invocations, making command injection practical and dangerous on a macOS host with GUI automation privileges.

Content

Scanner excerpt · scripts/send_message.py (reported line 52)May include surrounding context.

python

def run(cmd, timeout=15):
    log(f"→ {cmd[:120]}")
    result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=timeout)
    if result.returncode != 0 and result.stderr:
        log(f"  stderr: {result.stderr[:200]}")
    return result

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill invokes powerful local shell-based GUI automation tools but does not declare any explicit tool scope or permission boundaries. Because it also requires Accessibility and Screen Recording privileges, the absence of scoped permissions increases the risk of unintended command execution, opaque behavior, and abuse of highly sensitive desktop capabilities.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This skill depends on Screen Recording and Accessibility access, which are highly sensitive OS permissions that can expose on-screen data and allow control of other applications. Failing to clearly warn users in the skill description can cause them to grant broad privileges without understanding the privacy and security implications.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script forces OCR processing to use only Simplified Chinese, Traditional Chinese, and U.S. English via a fixed recognitionLanguages list. This is a natural-language policy concern because it imposes specific language/locale handling without offering the user a choice or documenting an opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The file-level natural-language instructions, usage text, and runtime-facing strings are entirely in Chinese, with no indication that the user can choose another language or that the locale restriction is intentional and documented as region-specific. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 97% confidence

Finding

The helper wraps subprocess.run with shell=True and is later used to build commands from untrusted inputs such as the recipient name, message text, screenshot path, and OCR keyword. Because several callers interpolate user-controlled or OCR-derived strings directly into shell command strings, an attacker can inject shell metacharacters and execute arbitrary commands on the host running the automation.

Content

Scanner excerpt · scripts/send_message.py (reported line 52)May include surrounding context.

python

def run(cmd, timeout=15):
    log(f"→ {cmd[:120]}")
    result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=timeout)
    if result.returncode != 0 and result.stderr:
        log(f"  stderr: {result.stderr[:200]}")
    return result

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This script performs real GUI automation to locate chats and send messages with no interactive confirmation, dry-run mode, recipient preview, or final send prompt. In the context of a messaging skill, this can cause unintended message delivery, misdirected communication due to OCR mistakes, or abuse by upstream prompts that trigger the skill without the operator fully understanding that it will send live messages.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The documentation includes a prescriptive instruction for Chinese input handling ('只用 ... paste 中文') and the overall skill description and trigger phrases are centered on Chinese usage without stating that this is optional or region-specific. This can be a language/locale policy issue because the skill appears to assume a specific language mode without user opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.