Security audit

Wechat Use

Security checks for vulnerabilities and agentic risk

Overview

This skill is a real WeChat automation integration, but it asks users to run high-risk installers and grants broad access to private WeChat data, sending, background services, and optional remote exposure with incomplete warnings.

Install only if you are comfortable granting a third-party native tool access to your local WeChat database key, chat history, contacts, media, Accessibility-driven sending, and background processes. Avoid the curl-to-bash and unpinned update paths unless you can verify the source yourself, do not expose the bridge remotely without strong bearer authentication and network controls, and treat the cached key like a password.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:230
Finding: Mutable Remote Installer Is Piped Directly into Bash
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:230, SKILL.md:288, and SKILL.md:722
Vulnerability Type: Remote payload retrieval and immediate shell execution
Risk Level: Critical

Vulnerable Code

bash
curl -fsSL https://raw.githubusercontent.com/leeguooooo/wechat-use/main/install.sh | bash

The same command is recommended for initial installation, troubleshooting LaunchAgent problems, and upgrading the tool.

Technical Analysis

The command retrieves install.sh from the mutable main branch of a personal GitHub repository and immediately executes the response with Bash. It does not:

Pin an immutable commit or release version.

Verify a cryptographic hash or digital signature.

Save the installer for review before execution.

Confirm the final resolved URL or release asset.

Constrain the commands that the remote script may execute.

Consequently, the effective code executed on a user's machine can change after the Skill has been reviewed. Compromise of the repository, maintainer account, release process, or network trust chain could turn an otherwise legitimate installation command into arbitrary code execution.

The risk is amplified because the installed tool is intended to access decrypted WeChat data, message content, contacts, Accessibility APIs, local debugging facilities, and persistent daemon infrastructure.

Attack Path

An attacker compromises the upstream repository, maintainer account, or publication process.

The attacker modifies install.sh on the main branch or changes the assets that it downloads.

The Skill encounters a missing installation, upgrade condition, or LaunchAgent troubleshooting condition.

The agent or user runs the documented curl ... | bash command.

Bash executes the modified response immediately, without integrity verification or local review.

The payload can install additional executables, replace the WeChat too ...[truncated 933 chars]
Remediation: View remediation
Remediation Suggestions

Remove every direct network-to-shell pipeline.

Pin installation to an immutable release and commit rather than main.

Download the installer and binary as separate files.

Publish SHA-256 or stronger checksums through an independently protected release channel.

Sign release artifacts and verify the signature before execution.

Display the downloaded script or require explicit user review and confirmation before running it.

Fail closed if the URL redirects unexpectedly or any integrity check fails.

Document all installer side effects, including binary installation, LaunchAgent changes, quarantine handling, and configuration changes.

Prefer a notarized, reproducibly built package distributed through a verifiable release mechanism.

T08 · Insecure Dependencies

Error

Location: SKILL.md:705
Finding: Unverified Native Executable Bypasses Gatekeeper Quarantine
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:705 and SKILL.md:722-726
Vulnerability Type: Unsafe external binary installation and security-control removal
Risk Level: High

Vulnerable Code

markdown
- Binary is a standalone native executable (GitHub Releases). `install.sh` auto-clears macOS Gatekeeper quarantine attribute.

The documented installation mechanism is:

bash
curl -fsSL https://raw.githubusercontent.com/leeguooooo/wechat-use/main/install.sh | bash

The accompanying description states that this operation pulls the latest tagged release binary, installs it under ~/.local/bin, and clears its Gatekeeper quarantine attribute.

Technical Analysis

The native executable is not included in the audited artifact. Its implementation and final behavior therefore cannot be verified from SKILL.md and DISCLAIMER.md. The documentation does not describe signature, notarization, provenance, or checksum verification before execution.

Automatically removing the macOS quarantine attribute weakens an operating-system security boundary intended to subject downloaded applications to provenance and Gatekeeper checks. Clearing quarantine is especially risky when the binary was obtained through an unpinned remote installer.

This is not a minimum privilege required to provide WeChat automation. A legitimate binary can instead be signed, notarized, and distributed through a verifiable release process without automatically bypassing quarantine checks.

Attack Path

An attacker substitutes the release binary or modifies the installer to download an attacker-controlled binary.

The installer retrieves the substituted executable without a documented signature or checksum verification step.

The installer clears the executable's quarantine attribute.

The user or agent invokes the apparently legitimate wechat or wechat-use command.

The substituted binary executes in a con ...[truncated 863 chars]
Remediation: View remediation
Remediation Suggestions

Do not automatically clear com.apple.quarantine.

Distribute a properly code-signed and notarized macOS executable.

Publish reproducible build instructions and source corresponding to each release.

Pin the exact release asset and verify a cryptographic signature and checksum before installation.

Make the installer abort if code-signing, notarization, checksum, or provenance checks fail.

Present the binary origin, version, hash, requested permissions, and installation destination to the user before installation.

Separate optional high-risk components such as message sending, debugging, remote bridges, and persistence so users install only the capabilities they need.

Provide a restricted or read-only mode that does not request Accessibility or debugging access when those permissions are unnecessary.

T08 · Insecure Dependencies

Warning

Location: SKILL.md:756
Finding: Unpinned Global Skill Update Uses Network-Fetched Package Tooling
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:756-760
Vulnerability Type: Unpinned dependency execution and global Skill replacement
Risk Level: Medium

Vulnerable Code

bash
# refresh skill files (including this SKILL.md) from the public repo npx skills update leeguooooo/wechat-use -g

Technical Analysis

The command does not pin the version or integrity of the package tooling invoked through npx, nor does it pin the revision of leeguooooo/wechat-use being installed. Depending on local cache state and npx behavior, package code may be downloaded and executed at invocation time.

The global update flag also expands the impact: changed Skill instructions can replace the globally installed copy and affect later sessions. Although no malicious package is proven in the audited files, the update design creates a supply-chain execution path whose effective behavior is not fixed at review time.

Attack Path

An attacker compromises the relevant package, package publisher, source repository, or update channel.

The user or agent runs the documented unpinned npx update command.

Network-fetched package code executes under the current user's account.

The command installs a changed Skill globally.

The altered Skill can influence future agent actions or direct the agent to execute additional attacker-controlled commands.

Impact Assessment

Exploitation could provide arbitrary code execution through compromised package tooling or persistent replacement of globally installed Skill instructions. The scope includes files writable by the current user and future sessions that load the globally updated Skill.

This finding is less severe than the direct curl | bash path because exploitation depends on compromise or malicious modification of an upstream dependency or update source.
Remediation: View remediation
Remediation Suggestions

Pin the exact npx package name and version.

Pin the Skill update to an immutable commit or signed release.

Use lockfiles and package integrity metadata where applicable.

Download updates into a staging directory and show a diff before global installation.

Require explicit user approval before replacing global Skill files.

Verify publisher identity, signatures, and checksums.

Avoid global installation by default; prefer a project-local or versioned installation that can be rolled back.

Record the installed package version, Skill commit, and integrity digest for later auditing.

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:683
Finding: Local-Only Privacy Claim Contradicts Documented Network Data Flows
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:683, conflicting with SKILL.md:155-159, SKILL.md:671, and SKILL.md:751
Vulnerability Type: Misleading security documentation for sensitive network transmission
Risk Level: Medium

Vulnerable Code

The Skill makes the following absolute claim:

markdown
- Everything runs **100% locally** — no data leaves the machine.

However, it also documents remote and outbound modes:

markdown
| **`wechat-use tunnel` (v1.11+)** | `wechat-use tunnel setup` | Expose local REST bridge to a remote service via Cloudflare Tunnel; details in `docs/remote-gateway.md`, do NOT inline the full setup flow in this skill. | | **`wechat-use orchestrate` (v1.12+)** | `wechat-use orchestrate setup --outbox-url= --webhook-url= --bearer= --webhook-secret=` | Long-running worker that polls a SaaS outbox API and pushes SSE inbound events to a SaaS webhook. NAT-friendly (Mac all-outbound, no public IP / domain). Used by SaaS integrations (cherry-class). Protocol: `docs/v1.12-orchestrate-protocol.md`. Don't inline the SaaS-side endpoint design here. |

It further recommends a message callback that performs an HTTP POST:

markdown
- "把微信消息接进我的 AI assistant" → `wechat-use listen --format json --on-message "curl -X POST ..."`

The build-probing function also performs an outbound transfer:

markdown
This hashes the local dylib, runs `literal_scan` to verify SQLCipher key extraction, pattern-matches three routing anchors against the ARM64 slice, and POSTs the derived numerical shifts to the adaptation queue. **Does not upload binary bytes.**

Technical Analysis

The assertion that no data leaves the machine is inconsistent with documented capabilities that:

Expose the local REST bridge through Cloudflare Tunnel.

Poll a remote SaaS outbox.

Push inbound WeChat events to a remote webhook.

Run arbitrary shell callbacks that may use curl.

...[truncated 1997 chars]
Remediation: View remediation
Remediation Suggestions

Replace the absolute local-only claim with an accurate per-feature data-flow statement.

Provide a table listing each network-enabled feature, destination, protocol, transmitted fields, authentication method, and retention implications.

Keep tunneling, orchestration, build telemetry, and remote callbacks disabled by default.

Require explicit informed consent before enabling any outbound or remotely exposed mode.

Require TLS certificate validation and authenticated endpoints for all non-local connections.

Require strong bearer authentication for every sensitive bridge route when tunneling; do not leave authentication optional for remote deployments.

Redact message content and identifiers unless they are strictly necessary for the selected integration.

Store bearer tokens and webhook secrets in protected credential storage rather than command history or plaintext configuration.

Document exact probe-build destination and payload fields and provide a telemetry opt-out.

Provide safe callback examples that pass message data through standard input or structured files rather than interpolating untrusted values into shell commands.

Apply destination allowlists, request-size limits, rate limits, and audit logging to remote integrations.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence

Findings (21)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The top-level description advertises remote tunnel setup that exposes the local REST API, but does not foreground the security consequences of publishing a message send/history interface outside localhost. Because this tool handles decrypted chat data and message-sending capability, accidental external exposure could enable account abuse or privacy compromise.
Content: No source excerpt is available for this finding.

Chaining Abuse

High

Category: Tool Misuse
Confidence: 88% confidence
Finding: Piping a fetched script directly into bash creates a dangerous chain from remote content to immediate code execution. This removes review and integrity controls, and if abused could install malware, modify persistence, or steal the highly sensitive local keys and chat data this tool manages.
Content: Scanner excerpt · SKILL.md (reported line 230)May include surrounding context.
If missing:

bash
curl -fsSL https://raw.githubusercontent.com/leeguooooo/wechat-use/main/install.sh | bash # Ensure ~/.local/bin is on PATH case "${SHELL##*/}" in fish) fish_add_path "$HOME/.local/bin" ;;

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · SKILL.md (reported line 235)May include surrounding context.
ommand -v wechat

text
If missing: ```bash curl -fsSL https://raw.githubusercontent.com/leeguooooo/wechat-use/main/install.sh | bash # Ensure ~/.local/bin is on PATH case "${SHELL##*/}" in fish) fish_add_path "$HOME/.local/bin" ;; zsh) grep -q '.local/bin' ~/.zshrc 2>/dev/null || echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.zshrc ;; bash) grep -q '.local/bin' ~/.bashrc 2>/dev/null || echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.bashrc ;; esac export PATH="$HOME/.local/bin:$PATH"

Step 2 — Run wechat-use init (required before any query command):

bash
wechat-use init

This restarts WeChat (closes current session + relaunches) in order to capture the decryption key at login. Tell the user:

"Going to briefly close and relaunch WeChat to extract the local database key. Any draft messages in WeChat will be lost — confirm before proceeding. **After WeChat relaunches, you must click 「进入 WeChat」 (or scan QR if no cached account) within ~5 mi

Chaining Abuse

High

Category: Tool Misuse
Confidence: 88% confidence
Finding: The upgrade path repeats the same fetch-and-execute chaining pattern, which is particularly risky because update operations are often performed routinely and with less scrutiny. A compromised upstream installer could silently gain code execution and access the user's WeChat data environment.
Content: Scanner excerpt · SKILL.md (reported line 722)May include surrounding context.
Upgrade to latest (safe, idempotent) — re-run install.sh with --force, or without it (it overwrites by default):

bash
curl -fsSL https://raw.githubusercontent.com/leeguooooo/wechat-use/main/install.sh | bash

That pulls the latest tagged release binary from GitHub, re-installs to ~/.local/bin/wechat, and re-clears any Gatekeeper quarantine attribute. No data is lost — ~/.wechat/keys.json + state.json are untouched.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 753)May include surrounding context.
md
**Updating the skill metadata** (this `SKILL.md` itself, when the agent is installed via `skills.sh`):

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 88% confidence
Finding: The skill tells the agent to automatically choose candidates[0].wxid and retry sending without asking the user when recency heuristics favor one match. Autonomous recipient selection in a messaging context can cause misdelivery of private or sensitive messages to the wrong person or group, which is a meaningful confidentiality and integrity risk.
Content: Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.
}

text
Agent should: read `candidates[0].wxid`, retry `wechat-use send "<text>" <wxid>`. Don't ask the user unless the top candidate has no recent activity or multiple candidates do. ## HTTP Bridge for agent integration (v1.10+)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.
md
wechat-bridge & # Health + send-readiness curl http://127.0.0.1:18400/health # Send curl -X POST http://127.0.0.1:18400/send \

Session Persistence

Medium

Category: Rogue Agent
Confidence: 80% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 288)May include surrounding context.
md
| `delivery_verify_timeout` / `slot_send_bp_armed_no_fire` | WeChat (re)launched but its internal send pipeline not yet wired | Tell user: open WeChat → click 「文件传输助手」→ type any message → press Enter. Then retry `wechat-use send`. (See Step 4 above.) | | `wechat_not_running` | WeChat.app not launched | Run `open -a WeChat`. If from a non-aqua SSH session, fall back to `osascript -e 'tell application "WeChat" to activate'`. Wait ~5s before retrying. | | `slot_send_bp_failed_to_arm` (detail: `send adapter install did not complete within 30s`) | WeChat has `get-task-allow=false` (official default signing); wechatd's local debugging interface can't connect | Run `wechat-use doctor` to confirm `wechat_get_task_allow ✗`. Then ask the user to copy-run the **merge-mode re-sign block** that `install.sh` prints (or `wechat-use doctor` suggests). Needs sudo, must be run by the user. Do NOT use a replace-mode `codesign --entitlements ...` command — it strips WeChat's existing system entitlements and breaks TCC for WeChat itself. | | `daemon_accessibility FAIL` / `ax_trusted=false` after a recent install/upgrade | Multiple `ai.wechat.*` LaunchAgents on the machine — orchestrate (KeepAlive) re-spawned wechatd with a stale launchd responsibility chain | Re-run `curl -fsSL https://raw.githubusercontent.com/leeguooooo/wechat-use/main/install.sh \| bash`. v1.16.12+ install.sh bootouts every `ai.wechat.*.plist` and bootstraps in the right order. Don't try to surgically `launchctl kickstart` — it doesn't reset the responsibility chain. | | `tcc_accessibility_denied` (wechat-bridge or wechatd untrusted) | User hasn't dragged binaries into System Settings → Privacy & Security → 辅助功能, or dragged them but didn't toggle ON | Open the pane: `open "x-apple.systempreferences:com.apple.preference.security?Privacy_Accessibility"` + `open ~/.local/bin`. Tell user to drag both `wechatd` and `wechat-bridge` in **and** toggle both to ON. macOS strictly requires user-initiated drag — no automation ca ...[truncated 25 chars]

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 288)May include surrounding context.
md
| `delivery_verify_timeout` / `slot_send_bp_armed_no_fire` | WeChat (re)launched but its internal send pipeline not yet wired | Tell user: open WeChat → click 「文件传输助手」→ type any message → press Enter. Then retry `wechat-use send`. (See Step 4 above.) | | `wechat_not_running` | WeChat.app not launched | Run `open -a WeChat`. If from a non-aqua SSH session, fall back to `osascript -e 'tell application "WeChat" to activate'`. Wait ~5s before retrying. | | `slot_send_bp_failed_to_arm` (detail: `send adapter install did not complete within 30s`) | WeChat has `get-task-allow=false` (official default signing); wechatd's local debugging interface can't connect | Run `wechat-use doctor` to confirm `wechat_get_task_allow ✗`. Then ask the user to copy-run the **merge-mode re-sign block** that `install.sh` prints (or `wechat-use doctor` suggests). Needs sudo, must be run by the user. Do NOT use a replace-mode `codesign --entitlements ...` command — it strips WeChat's existing system entitlements and breaks TCC for WeChat itself. | | `daemon_accessibility FAIL` / `ax_trusted=false` after a recent install/upgrade | Multiple `ai.wechat.*` LaunchAgents on the machine — orchestrate (KeepAlive) re-spawned wechatd with a stale launchd responsibility chain | Re-run `curl -fsSL https://raw.githubusercontent.com/leeguooooo/wechat-use/main/install.sh \| bash`. v1.16.12+ install.sh bootouts every `ai.wechat.*.plist` and bootstraps in the right order. Don't try to surgically `launchctl kickstart` — it doesn't reset the responsibility chain. | | `tcc_accessibility_denied` (wechat-bridge or wechatd untrusted) | User hasn't dragged binaries into System Settings → Privacy & Security → 辅助功能, or dragged them but didn't toggle ON | Open the pane: `open "x-apple.systempreferences:com.apple.preference.security?Privacy_Accessibility"` + `open ~/.local/bin`. Tell user to drag both `wechatd` and `wechat-bridge` in **and** toggle both to ON. macOS strictly requires user-initiated drag — no automation ca ...[truncated 25 chars]

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 295)May include surrounding context.
md
| `delivery_verify_timeout` / `slot_send_bp_armed_no_fire` | WeChat (re)launched but its internal send pipeline not yet wired | Tell user: open WeChat → click 「文件传输助手」→ type any message → press Enter. Then retry `wechat-use send`. (See Step 4 above.) | | `wechat_not_running` | WeChat.app not launched | Run `open -a WeChat`. If from a non-aqua SSH session, fall back to `osascript -e 'tell application "WeChat" to activate'`. Wait ~5s before retrying. | | `slot_send_bp_failed_to_arm` (detail: `send adapter install did not complete within 30s`) | WeChat has `get-task-allow=false` (official default signing); wechatd's local debugging interface can't connect | Run `wechat-use doctor` to confirm `wechat_get_task_allow ✗`. Then ask the user to copy-run the **merge-mode re-sign block** that `install.sh` prints (or `wechat-use doctor` suggests). Needs sudo, must be run by the user. Do NOT use a replace-mode `codesign --entitlements ...` command — it strips WeChat's existing system entitlements and breaks TCC for WeChat itself. | | `daemon_accessibility FAIL` / `ax_trusted=false` after a recent install/upgrade | Multiple `ai.wechat.*` LaunchAgents on the machine — orchestrate (KeepAlive) re-spawned wechatd with a stale launchd responsibility chain | Re-run `curl -fsSL https://raw.githubusercontent.com/leeguooooo/wechat-use/main/install.sh \| bash`. v1.16.12+ install.sh bootouts every `ai.wechat.*.plist` and bootstraps in the right order. Don't try to surgically `launchctl kickstart` — it doesn't reset the responsibility chain. | | `tcc_accessibility_denied` (wechat-bridge or wechatd untrusted) | User hasn't dragged binaries into System Settings → Privacy & Security → 辅助功能, or dragged them but didn't toggle ON | Open the pane: `open "x-apple.systempreferences:com.apple.preference.security?Privacy_Accessibility"` + `open ~/.local/bin`. Tell user to drag both `wechatd` and `wechat-bridge` in **and** toggle both to ON. macOS strictly requires user-initiated drag — no automation ca ...[truncated 25 chars]

Session Persistence

Medium

Category: Rogue Agent
Confidence: 80% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 295)May include surrounding context.
md
**Key principle**: every `reason:` slot is stable enum; the support payload includes `ax_trusted`, `input_monitoring`, `binary_fingerprint`, `cli_version`, `daemon_version` — match on those exact field names, not on the human-readable Chinese error message (it may evolve across releases). **LaunchAgent / TCC handbook for agents**: if you ever need to manually reset responsibility chains (e.g. user's machine has a customized LaunchAgent layout), use `launchctl bootout` + `launchctl bootstrap` — never `launchctl kickstart -k`. `kickstart` doesn't re-read plist `EnvironmentVariables` and doesn't reset launchd's responsibility-chain cache. The `install.sh` upgrade flow is the reference implementation. ---

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This markdown file's trigger section lists phrases like "提醒 XXX 会议 5 分钟后开始" and "帮我盯着 Lisa 发来的消息" that can occur in ordinary conversation and are not consistently constrained to explicit WeChat intent. Although some examples mention WeChat, the section mixes specific and broad phrasings without negative examples or firm exclusion conditions, which could cause unintended invocation by an agent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The automation examples encourage auto-reply and HTTP forwarding of inbound messages without an equally prominent warning that handlers may exfiltrate private content or trigger unauthorized outbound actions. In a messaging skill, such examples materially increase the chance that operators deploy risky automations without understanding the privacy and abuse implications.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The document claims 'Everything runs 100% locally — no data leaves the machine' while elsewhere describing Cloudflare Tunnel, SaaS outbox/webhook orchestration, and HTTP forwarding patterns. This can mislead users into exposing highly sensitive chat data under a false assumption of locality, undermining informed consent and secure deployment decisions.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 81% confidence
Finding: The skill instructs use of npx skills update leeguooooo/wechat-use -g without pinning a version or commit. That causes execution of whatever package version is current at invocation time, which creates supply-chain risk if the package is updated maliciously or unexpectedly.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 81% confidence
Finding: A second unpinned npx skills reference repeats the same issue: remote code may be fetched and executed at latest version with no integrity pinning. In an agent skill, this is especially risky because operators may treat the instruction as trusted automation guidance.
Content: No source excerpt is available for this finding.

External Script Fetching

Low

Category: Supply Chain
Confidence: 93% confidence
Finding: curl ... | bash executes a remote script directly from the network with no pinning, checksum verification, or review step. In a security-sensitive tool that handles WeChat decryption keys and local chat access, compromise of the upstream script or transport path could lead to immediate code execution on the user's machine.
Content: Scanner excerpt · SKILL.md (reported line 230)May include surrounding context.
If missing:

bash
curl -fsSL https://raw.githubusercontent.com/leeguooooo/wechat-use/main/install.sh | bash # Ensure ~/.local/bin is on PATH case "${SHELL##*/}" in fish) fish_add_path "$HOME/.local/bin" ;;

External Script Fetching

Low

Category: Supply Chain
Confidence: 91% confidence
Finding: The troubleshooting flow again recommends curl ... | bash, normalizing unsafe remote-script execution during maintenance. Repeated inclusion increases the chance users will run privileged or security-impacting setup blindly when debugging a broken installation.
Content: Scanner excerpt · SKILL.md (reported line 288)May include surrounding context.
md
| `delivery_verify_timeout` / `slot_send_bp_armed_no_fire` | WeChat (re)launched but its internal send pipeline not yet wired | Tell user: open WeChat → click 「文件传输助手」→ type any message → press Enter. Then retry `wechat-use send`. (See Step 4 above.) | | `wechat_not_running` | WeChat.app not launched | Run `open -a WeChat`. If from a non-aqua SSH session, fall back to `osascript -e 'tell application "WeChat" to activate'`. Wait ~5s before retrying. | | `slot_send_bp_failed_to_arm` (detail: `send adapter install did not complete within 30s`) | WeChat has `get-task-allow=false` (official default signing); wechatd's local debugging interface can't connect | Run `wechat-use doctor` to confirm `wechat_get_task_allow ✗`. Then ask the user to copy-run the **merge-mode re-sign block** that `install.sh` prints (or `wechat-use doctor` suggests). Needs sudo, must be run by the user. Do NOT use a replace-mode `codesign --entitlements ...` command — it strips WeChat's existing system entitlements and breaks TCC for WeChat itself. | | `daemon_accessibility FAIL` / `ax_trusted=false` after a recent install/upgrade | Multiple `ai.wechat.*` LaunchAgents on the machine — orchestrate (KeepAlive) re-spawned wechatd with a stale launchd responsibility chain | Re-run `curl -fsSL https://raw.githubusercontent.com/leeguooooo/wechat-use/main/install.sh \| bash`. v1.16.12+ install.sh bootouts every `ai.wechat.*.plist` and bootstraps in the right order. Don't try to surgically `launchctl kickstart` — it doesn't reset the responsibility chain. | | `tcc_accessibility_denied` (wechat-bridge or wechatd untrusted) | User hasn't dragged binaries into System Settings → Privacy & Security → 辅助功能, or dragged them but didn't toggle ON | Open the pane: `open "x-apple.systempreferences:com.apple.preference.security?Privacy_Accessibility"` + `open ~/.local/bin`. Tell user to drag both `wechatd` and `wechat-bridge` in **and** toggle both to ON. macOS strictly requires user-initiated drag — no automation ca ...[truncated 25 chars]

External Script Fetching

Low

Category: Supply Chain
Confidence: 15% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 671)May include surrounding context.
md
**Realtime**: - "帮我盯着 Lisa 发来的消息，收到就自动回复 XXX" → `wechat-use daemon start` then `wechat-use listen --wxid <lisa-wxid> --on-message "..."` - "把微信消息接进我的 AI assistant" → `wechat-use listen --format json --on-message "curl -X POST ..."` - "监控这个群谁提到 '会议'，马上通知我" → `wechat-use listen --wxid <group>` + handler that greps Example user utterances and the right first call:

External Script Fetching

Low

Category: Supply Chain
Confidence: 15% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 671)May include surrounding context.
md
**Realtime**: - "帮我盯着 Lisa 发来的消息,收到就自动回复 XXX" → `wechat-use daemon start` then `wechat-use listen --wxid <lisa-wxid> --on-message "..."` - "把微信消息接进我的 AI assistant" → `wechat-use listen --format json --on-message "curl -X POST ..."` - "监控这个群谁提到 '会议',马上通知我" → `wechat-use listen --wxid <group>` + handler that greps Example user utterances and the right first call:

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill documents inconsistent storage paths for captured key material (~/.wx-rs/ in one section and ~/.wechat/keys.json in another). Conflicting guidance around where decryption keys are stored can cause users to misapply backups, permissions, incident response, or secret hygiene for extremely sensitive material.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:156

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

T08 · Insecure Dependencies

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

T08 · Insecure Dependencies

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Remediation Suggestions

SkillSpector

Missing User Warnings

Chaining Abuse

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

Chaining Abuse

Ae1

Autonomous Decision Making

External Transmission

Session Persistence

Session Persistence

Session Persistence

Session Persistence

Vague Triggers

Missing User Warnings

Intent-Code Divergence

Rp1

Rp1

External Script Fetching

External Script Fetching

External Script Fetching

External Script Fetching

Intent-Code Divergence

Static analysis

File appears to expose a hardcoded API secret or token.