Baoyu Wechat Summary

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:46 AM UTC
• Version: 1.117.4

Overview

This skill appears purpose-built for local WeChat summaries, but it asks for unusually broad local access and keeps long-lived named chat profiles.

Install only if you are comfortable granting a third-party wx CLI broad local access to WeChat data and keeping named plaintext summaries/profiles on disk. Prefer path-scoped sandbox permissions if available, verify and pin the wx-cli package yourself, store data_root in a private non-synced location, periodically delete old profile/history files, and avoid roast mode unless participants expect that style of summary.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:17

Finding

Blanket Sandbox Bypass for WeChat CLI Operations

Content

View full analysis

**⚠️ Sandbox restriction** > > wx-cli reads from `~/.wx-cli/` (config, cache, daemon socket) and from WeChat's data directory (`~/Library/Containers/com.tencent.xinWeChat/` on macOS). Both paths are outside Claude Code's default sandbox. Every `wx` command in this skill needs to run with `dangerouslyDisableSandbox: true` from the start — don't waste a sandbox attempt first. The user can use `/sandbox` to view/edit restrictions. ``` ### Technical Analysis The Skill requires every invocation of the external `wx` executable to run with `dangerouslyDisableSandbox: true`. Access to the WeChat data directory and `~/.wx-cli` is necessary for the declared summarization functionality, but disabling the entire sandbox grants substantially broader access than those specific paths require. The invoked executable is not included in this project, so its implementation and effective behavior cannot be verified by auditing this Skill. Once the sandbox is disabled, the process may potentially access unrelated user files, local credentials, authentication tokens, browser profiles, SSH keys, environment variables, and network resources available to the current account. This creates a security boundary failure even though the Skill itself does not contain an explicit exfiltration command. The risk materializes if the external executable is compromised, replaced, or resolved through an attacker-controlled `PATH`. ### Attack Path 1. An attacker compromises the installed `wx` package, replaces the local executable, or places a malicious executable earlier in `PATH`. 2. The user invokes the Skill to summarize a WeChat group. 3. Following the Skill instructions, the Agent runs `wx` with `dangerouslyDisableSandbox: true`. 4. The attacker-controlled proce ...[truncated 990 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:35

Finding

Unpinned Globally Installed Third-Party CLI Runs with Sensitive Access

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/profiles.md:110

Finding

Unbounded Retention of Identifiable Behavioral Profiles

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (22)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

If the directory exists but the owner is root (or anything other than $(whoami)), tell the user to repair it themselves:

bash

sudo chown -R $(whoami) ~/.wx-cli
sudo rm -f ~/.wx-cli/daemon.pid ~/.wx-cli/daemon.sock
wx daemon start

The skill should NOT run sudo on the user's behalf.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 533)May include surrounding context.

md

| Symptom | Cause | Fix (tell the user to run these — do NOT run `sudo` for them) |
|---------|-------|----------------------------------------------------------------|
| `Operation not permitted` / `Access denied to ~/.wx-cli` | Sandbox is on | Re-run the command with `dangerouslyDisableSandbox: true`. Persistent fix: `/sandbox` to allow `~/.wx-cli` and the WeChat data dir. |
| `无法写入 /Users/<u>/.wx-cli` / `Permission denied` | `~/.wx-cli` is owned by root (legacy `sudo wx init`) | `sudo chown -R $(whoami) ~/.wx-cli && sudo rm -f ~/.wx-cli/daemon.{pid,sock} && wx daemon start` |
| `wx history` hangs / times out / returns nothing | Daemon is stuck | `wx daemon stop && rm -f ~/.wx-cli/daemon.{pid,sock} && wx daemon start`, then retry |
| `no keys` / `init required` after the daemon was working | Keys went stale (WeChat restart, version upgrade) | Make sure WeChat is running, then `wx init --force` (non-sudo first; only `sudo` if your wx-cli version requires it) |
| `wx contacts` returns zero rows for a group you know exists | Group is folded into 折叠群 or the daemon hasn't indexed it yet | `wx sessions --json` and search there; if missing, run `wx daemon stop && wx daemon start` and retry |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 534)May include surrounding context.

md

| Symptom | Cause | Fix (tell the user to run these — do NOT run `sudo` for them) |
|---------|-------|----------------------------------------------------------------|
| `Operation not permitted` / `Access denied to ~/.wx-cli` | Sandbox is on | Re-run the command with `dangerouslyDisableSandbox: true`. Persistent fix: `/sandbox` to allow `~/.wx-cli` and the WeChat data dir. |
| `无法写入 /Users/<u>/.wx-cli` / `Permission denied` | `~/.wx-cli` is owned by root (legacy `sudo wx init`) | `sudo chown -R $(whoami) ~/.wx-cli && sudo rm -f ~/.wx-cli/daemon.{pid,sock} && wx daemon start` |
| `wx history` hangs / times out / returns nothing | Daemon is stuck | `wx daemon stop && rm -f ~/.wx-cli/daemon.{pid,sock} && wx daemon start`, then retry |
| `no keys` / `init required` after the daemon was working | Keys went stale (WeChat restart, version upgrade) | Make sure WeChat is running, then `wx init --force` (non-sudo first; only `sudo` if your wx-cli version requires it) |
| `wx contacts` returns zero rows for a group you know exists | Group is folded into 折叠群 or the daemon hasn't indexed it yet | `wx sessions --json` and search there; if missing, run `wx daemon stop && wx daemon start` and retry |

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 533)May include surrounding context.

md

| Symptom | Cause | Fix (tell the user to run these — do NOT run `sudo` for them) |
|---------|-------|----------------------------------------------------------------|
| `Operation not permitted` / `Access denied to ~/.wx-cli` | Sandbox is on | Re-run the command with `dangerouslyDisableSandbox: true`. Persistent fix: `/sandbox` to allow `~/.wx-cli` and the WeChat data dir. |
| `无法写入 /Users/<u>/.wx-cli` / `Permission denied` | `~/.wx-cli` is owned by root (legacy `sudo wx init`) | `sudo chown -R $(whoami) ~/.wx-cli && sudo rm -f ~/.wx-cli/daemon.{pid,sock} && wx daemon start` |
| `wx history` hangs / times out / returns nothing | Daemon is stuck | `wx daemon stop && rm -f ~/.wx-cli/daemon.{pid,sock} && wx daemon start`, then retry |
| `no keys` / `init required` after the daemon was working | Keys went stale (WeChat restart, version upgrade) | Make sure WeChat is running, then `wx init --force` (non-sudo first; only `sudo` if your wx-cli version requires it) |
| `wx contacts` returns zero rows for a group you know exists | Group is folded into 折叠群 or the daemon hasn't indexed it yet | `wx sessions --json` and search there; if missing, run `wx daemon stop && wx daemon start` and retry |

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 534)May include surrounding context.

md

|---------|-------|----------------------------------------------------------------|
| `Operation not permitted` / `Access denied to ~/.wx-cli` | Sandbox is on | Re-run the command with `dangerouslyDisableSandbox: true`. Persistent fix: `/sandbox` to allow `~/.wx-cli` and the WeChat data dir. |
| `无法写入 /Users/<u>/.wx-cli` / `Permission denied` | `~/.wx-cli` is owned by root (legacy `sudo wx init`) | `sudo chown -R $(whoami) ~/.wx-cli && sudo rm -f ~/.wx-cli/daemon.{pid,sock} && wx daemon start` |
| `wx history` hangs / times out / returns nothing | Daemon is stuck | `wx daemon stop && rm -f ~/.wx-cli/daemon.{pid,sock} && wx daemon start`, then retry |
| `no keys` / `init required` after the daemon was working | Keys went stale (WeChat restart, version upgrade) | Make sure WeChat is running, then `wx init --force` (non-sudo first; only `sudo` if your wx-cli version requires it) |
| `wx contacts` returns zero rows for a group you know exists | Group is folded into 折叠群 or the daemon hasn't indexed it yet | `wx sessions --json` and search there; if missing, run `wx daemon stop && wx daemon start` and retry |
| Messages returned but `--since` / `--until` window looks wrong | Date string not in `YYYY-MM-DD` format, or off-by-one timezone | Confirm the dates are local-time `YYYY-MM-DD`. Re-filter the JSON by `timestamp` locally as a belt-and-suspenders step. |

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The invocation description includes phrases like "帮我看看 XX 群最近聊了什么" and "XX 群有什么值得看的", which overlap with ordinary conversational requests and do not clearly bound when this skill should activate versus a general assistant response. The description provides examples but no explicit exclusion conditions or negative examples to prevent accidental triggering.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill persistently stores chat-derived digests, user profiles, and group memory across runs, but the user-facing description does not prominently warn about that retention. This creates a privacy risk because users may invoke the skill expecting transient summarization while sensitive interpersonal data is actually retained on disk for future processing.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

Before invoking the workflow, verify the environment. Run these checks in order; stop at the first failure and surface the exact next command the user needs.

1. wx-cli installed — run wx --version. If missing, tell the user to install it themselves (npm install -g @jackwener/wx-cli or use one of the alternatives at https://github.com/jackwener/wx-cli). Do NOT auto-install — this repo forbids piped/silent installs.
2. ~/.wx-cli directory owned by the current user — sudo wx init historically chowned this directory to root, which breaks every subsequent non-sudo wx call. Check:

   bash

   ls -la ~/.wx-cli/ 2>/dev/null | head -5
   

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

Before invoking the workflow, verify the environment. Run these checks in order; stop at the first failure and surface the exact next command the user needs.

1. wx-cli installed — run wx --version. If missing, tell the user to install it themselves (npm install -g @jackwener/wx-cli or use one of the alternatives at https://github.com/jackwener/wx-cli). Do NOT auto-install — this repo forbids piped/silent installs.
2. ~/.wx-cli directory owned by the current user — sudo wx init historically chowned this directory to root, which breaks every subsequent non-sudo wx call. Check:

   bash

   ls -la ~/.wx-cli/ 2>/dev/null | head -5
   

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

Before invoking the workflow, verify the environment. Run these checks in order; stop at the first failure and surface the exact next command the user needs.

1. wx-cli installed — run wx --version. If missing, tell the user to install it themselves (npm install -g @jackwener/wx-cli or use one of the alternatives at https://github.com/jackwener/wx-cli). Do NOT auto-install — this repo forbids piped/silent installs.
2. ~/.wx-cli directory owned by the current user — sudo wx init historically chowned this directory to root, which breaks every subsequent non-sudo wx call. Check:

   bash

   ls -la ~/.wx-cli/ 2>/dev/null | head -5
   

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

Before invoking the workflow, verify the environment. Run these checks in order; stop at the first failure and surface the exact next command the user needs.

1. wx-cli installed — run wx --version. If missing, tell the user to install it themselves (npm install -g @jackwener/wx-cli or use one of the alternatives at https://github.com/jackwener/wx-cli). Do NOT auto-install — this repo forbids piped/silent installs.
2. ~/.wx-cli directory owned by the current user — sudo wx init historically chowned this directory to root, which breaks every subsequent non-sudo wx call. Check:

   bash

   ls -la ~/.wx-cli/ 2>/dev/null | head -5
   

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 535)May include surrounding context.

Before invoking the workflow, verify the environment. Run these checks in order; stop at the first failure and surface the exact next command the user needs.

1. wx-cli installed — run wx --version. If missing, tell the user to install it themselves (npm install -g @jackwener/wx-cli or use one of the alternatives at https://github.com/jackwener/wx-cli). Do NOT auto-install — this repo forbids piped/silent installs.
2. ~/.wx-cli directory owned by the current user — sudo wx init historically chowned this directory to root, which breaks every subsequent non-sudo wx call. Check:

   bash

   ls -la ~/.wx-cli/ 2>/dev/null | head -5
   

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

1. wx-cli installed — run wx --version. If missing, tell the user to install it themselves (npm install -g @jackwener/wx-cli or use one of the alternatives at https://github.com/jackwener/wx-cli). Do NOT auto-install — this repo forbids piped/silent installs.
2. ~/.wx-cli directory owned by the current user — sudo wx init historically chowned this directory to root, which breaks every subsequent non-sudo wx call. Check:

   bash

   ls -la ~/.wx-cli/ 2>/dev/null | head -5
   

   If the directory exists but the owner is root (or anything other than $(whoami)), tell the user to repair it themselves:

   bash

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 533)May include surrounding context.

md

| Symptom | Cause | Fix (tell the user to run these — do NOT run `sudo` for them) |
|---------|-------|----------------------------------------------------------------|
| `Operation not permitted` / `Access denied to ~/.wx-cli` | Sandbox is on | Re-run the command with `dangerouslyDisableSandbox: true`. Persistent fix: `/sandbox` to allow `~/.wx-cli` and the WeChat data dir. |
| `无法写入 /Users/<u>/.wx-cli` / `Permission denied` | `~/.wx-cli` is owned by root (legacy `sudo wx init`) | `sudo chown -R $(whoami) ~/.wx-cli && sudo rm -f ~/.wx-cli/daemon.{pid,sock} && wx daemon start` |
| `wx history` hangs / times out / returns nothing | Daemon is stuck | `wx daemon stop && rm -f ~/.wx-cli/daemon.{pid,sock} && wx daemon start`, then retry |
| `no keys` / `init required` after the daemon was working | Keys went stale (WeChat restart, version upgrade) | Make sure WeChat is running, then `wx init --force` (non-sudo first; only `sudo` if your wx-cli version requires it) |
| `wx contacts` returns zero rows for a group you know exists | Group is folded into 折叠群 or the daemon hasn't indexed it yet | `wx sessions --json` and search there; if missing, run `wx daemon stop && wx daemon start` and retry |

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 555)May include surrounding context.

md

| Symptom | Cause | Fix (tell the user to run these — do NOT run `sudo` for them) |
|---------|-------|----------------------------------------------------------------|
| `Operation not permitted` / `Access denied to ~/.wx-cli` | Sandbox is on | Re-run the command with `dangerouslyDisableSandbox: true`. Persistent fix: `/sandbox` to allow `~/.wx-cli` and the WeChat data dir. |
| `无法写入 /Users/<u>/.wx-cli` / `Permission denied` | `~/.wx-cli` is owned by root (legacy `sudo wx init`) | `sudo chown -R $(whoami) ~/.wx-cli && sudo rm -f ~/.wx-cli/daemon.{pid,sock} && wx daemon start` |
| `wx history` hangs / times out / returns nothing | Daemon is stuck | `wx daemon stop && rm -f ~/.wx-cli/daemon.{pid,sock} && wx daemon start`, then retry |
| `no keys` / `init required` after the daemon was working | Keys went stale (WeChat restart, version upgrade) | Make sure WeChat is running, then `wx init --force` (non-sudo first; only `sudo` if your wx-cli version requires it) |
| `wx contacts` returns zero rows for a group you know exists | Group is folded into 折叠群 or the daemon hasn't indexed it yet | `wx sessions --json` and search there; if missing, run `wx daemon stop && wx daemon start` and retry |

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The roast-mode instructions direct the model to produce personalized insulting commentary about identifiable participants, but there is no strong user warning, acknowledgement gate, or safeguard against reputational harm. Even with redlines, this can still generate targeted mockery that is socially harmful when derived from real chat logs.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The instruction to write the 'harshest version' first encourages the model to generate unsafe insulting content before applying safety checks. In practice, that increases the chance of producing humiliating or policy-violating personalized attacks, especially since the skill works from real group-chat identities and persistent profiles.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The format explicitly requires retaining real names, gossip, anecdotes, and recognizable phrasing in persistent digests. That creates a privacy and reputational risk because sensitive social content is normalized into a durable summary artifact that is easier to search, share, and reuse than the original chat, undermining the claimed privacy guardrails.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Keeping real names and preserving gossip in output without a user-facing privacy warning or consent mechanism exposes participants to privacy leakage and reputational harm. The danger is amplified because summaries are designed as memory artifacts, making informal chat details persist beyond their original context.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The profile system is explicitly designed to maintain long-lived per-user histories, quotes, aliases, interaction patterns, and notable events across runs. This creates durable behavioral dossiers that can outlive the original conversational context, increasing privacy harm, re-identification risk, and the blast radius of any local compromise or later misuse, despite the document's attempt to exclude some sensitive categories.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The backfill flow materially expands the skill from producing a one-off chat summary into constructing persistent per-user dossiers from historical digests. Even with stated privacy guardrails, this enables large-scale retrospective profiling, identity resolution via wx contacts lookup, and accumulation of behavioral history that increases surveillance and data-minimization risk if the files are exposed, reused, or repurposed.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This example preferences file includes multiple Chinese-language instructions and values, such as the nickname lookup example and the bot alias guidance, without indicating that users may use another language or locale. That can violate a language/locale policy when a skill implicitly assumes a specific language for setup or operation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.