Wechat Voice

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:05 PM UTC
• Version: 0.1.0

Overview

The skill appears to perform WeChat voice transcription, but it needs review because decoded voice files can remain in predictable temporary paths and its Python dependencies are unpinned.

Review this before installing if the voice messages may contain private or regulated information. Prefer running it in an isolated environment, pin and review the Python package versions, and avoid the default output path unless the script is updated to use unique temporary files and clean them up after transcription.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:48

Finding

Unpinned Third-Party Dependencies Create a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:48-57
Vulnerability Type: Unpinned dependency installation
Risk Level: Medium

Vulnerable Code

markdown

### Python packages needed

Install locally with:

```bash
python3 -m pip install --user silk-python faster-whisper

Use silk-python to decode WeChat SILK audio in Python. Use faster-whisper for local CPU transcription.

text

### Technical Analysis

The documented installation command installs `silk-python` and `faster-whisper` without pinned versions or integrity hashes. Consequently, the code installed depends on whichever package versions the configured Python package index serves at installation time.

Python packages can execute code during installation through build backends and later when imported. The script imports both dependencies at runtime:

```python
import pysilk
from faster_whisper import WhisperModel

Therefore, compromise of an upstream package, package-index account, dependency resolution path, or transitive dependency could introduce arbitrary code that was not present during this audit. Unpinned releases also create reproducibility and compatibility risks even without malicious interference.

Attack Path

1. An attacker compromises a named package, one of its transitive dependencies, or the package-index delivery path.
2. The compromised dependency publishes a malicious release that still satisfies the unconstrained installation command.
3. An operator follows the documented pip install --user command.
4. Malicious code executes during package installation or when the transcription script imports the affected package.
5. The code runs with the privileges and filesystem access of the user installing or invoking the Skill.

Impact Assessment

Successful exploitation can provide arbitrary code execution under the invoking user's account. This may expose audio attachments, transcripts, accessible ...[truncated 233 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the unconstrained installation command with a reviewed, version-locked requirements file.
• Pin all direct and transitive dependencies to exact versions.
• Generate and verify cryptographic hashes, for example by installing with pip install --require-hashes -r requirements.txt.
• Obtain packages only from an explicitly configured trusted index.
• Periodically scan locked dependencies for known vulnerabilities and review updates before changing the lock file.
• Install dependencies inside a dedicated virtual environment or isolated container rather than the user's general Python environment.
• Document the expected package names, versions, hashes, and provenance so dependency confusion or unexpected resolution can be detected.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/transcribe_wechat_voice.py:12

Finding

Predictable Temporary Paths Permit Symlink Overwrites and Retain Sensitive Audio

Content

View full analysis

Vulnerability Details

File Location: scripts/transcribe_wechat_voice.py:12-25,55
Vulnerability Type: Unsafe temporary-file handling and incomplete sensitive-data cleanup
Risk Level: Medium

Vulnerable Code

python

def decode_silk_to_wav(src: Path, wav: Path, sample_rate: int = 24000) -> None:
    import pysilk

    pcm_path = wav.with_suffix('.pcm')
    with src.open('rb') as fi, pcm_path.open('wb') as fo:
        pysilk.decode(fi, fo, sample_rate)

    raw = pcm_path.read_bytes()
    with wave.open(str(wav), 'wb') as wf:
        wf.setnchannels(1)
        wf.setsampwidth(2)
        wf.setframerate(sample_rate)
        wf.writeframes(raw)

    pcm_path.unlink(missing_ok=True)

python

wav = Path(sys.argv[2]) if len(sys.argv) > 2 else Path('/tmp/wechat-voice-decoded.wav')

Technical Analysis

When no output path is supplied, every invocation uses the predictable shared path /tmp/wechat-voice-decoded.wav. SILK decoding also derives the predictable path /tmp/wechat-voice-decoded.pcm.

The PCM file is opened with ordinary write semantics and no exclusive-creation or symbolic-link protection. The WAV output is similarly opened by wave.open, or written by ffmpeg for non-SILK input. Existing paths can therefore be replaced or followed. In a shared local environment, an attacker who can create entries in /tmp may place a symbolic link at either predictable path before the Skill executes, causing output to be written through that link to another file writable by the invoking user.

Cleanup is also incomplete. The PCM file is deleted only after every preceding operation succeeds, so decode, read, or WAV-generation failures can leave raw speech data behind. The default decoded WAV is never deleted after transcription. These files contain a decoded form of the user's voice attachment and may remain accessible to local principals according to filesystem permissions and the pr ...[truncated 1621 chars]

Remediation

View remediation

Remediation Suggestions

• Use tempfile.TemporaryDirectory() or tempfile.NamedTemporaryFile() to generate unique, securely created paths for each invocation.
• Create temporary files with restrictive permissions, such as mode 0600, and avoid shared deterministic names.
• Do not reopen temporary files by predictable pathname when a securely created file descriptor can be used.
• Reject symbolic links for user-supplied output paths and use safe open flags such as O_CREAT | O_EXCL | O_NOFOLLOW where supported.
• Place cleanup in a try/finally block so PCM and default WAV files are deleted after success or failure.
• Retain a WAV only when the caller explicitly requests an output path.
• Validate that explicit output paths are regular files in an authorized destination.
• Isolate concurrent executions by assigning each request its own temporary directory.
• Consider limiting input size and decoded output duration to reduce temporary storage and resource-exhaustion exposure.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill instructs the agent to read local files and execute shell commands, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization gap: a host may grant broader capabilities than necessary, and the skill can be invoked in contexts where its file and shell access are not clearly constrained to the intended audio-processing task.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/transcribe_wechat_voice.py (reported line 34)May include surrounding context.

python

if is_silk(src):
        decode_silk_to_wav(src, wav)
    else:
        subprocess.run(
            ['ffmpeg', '-y', '-i', str(src), str(wav)],
            check=True,
            stdout=subprocess.DEVNULL,

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code hard-codes language='zh' for transcription, which forces a specific language/locale behavior for all inputs. This matches the policy category for language or locale constraints because the user is not offered any opt-in, override, or documented justification for limiting transcription to Chinese.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.