ClawHub
Back to skill

Security audit

wechat-message

Security checks across malware telemetry and agentic risk

Overview

This WeChat automation skill can read chats, send them to a configurable AI service, and automatically reply, while its privacy text says no data is uploaded.

Review before installing. Use only with chats you are authorized to process, prefer a local or trusted API endpoint, avoid passing secrets where shell history can capture them, and keep auto_process supervised because it can transmit message contents and send WeChat replies automatically.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
startupinfo.wShowWindow = 1
                    CREATE_NO_WINDOW = 0x08000000

                    process = subprocess.Popen(
                        [wechat_path],
                        startupinfo=startupinfo,
                        shell=True,
Confidence
89% confidence
Finding
process = subprocess.Popen( [wechat_path], startupinfo=startupinfo, shell=True, crea

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The skill is presented as local desktop WeChat automation, but it also implements automatic extraction of chat messages and forwarding of their contents to a configurable AI API for reply generation. This creates a clear data exfiltration risk because private conversations can leave the local device without prominent consent or scope restriction.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The code bundles chat content into a request body and sends it to a configurable `api_url`, which may be external. This is dangerous because sensitive user conversations can be transmitted to an arbitrary endpoint, enabling privacy violations, unauthorized retention, or further compromise if the endpoint is attacker-controlled.

Intent-Code Divergence

High
Confidence
98% confidence
Finding
The document claims all operations stay local and that no data is uploaded, but it also instructs users to configure an external AI API for automated replies. That contradiction can mislead users into exposing chat content, contact data, or message context to remote services without informed consent. In a WeChat automation skill that can extract chat history, this inconsistency materially increases privacy risk.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The skill is presented primarily as local desktop UI automation, yet it includes external AI API integration requiring an API key and remote endpoint. This expands the trust boundary beyond the local machine and creates a path for chat content or derived context to leave the device, which is security-relevant because the extra capability is not central to the base automation description.

Missing User Warnings

High
Confidence
97% confidence
Finding
Copied chat history is sent to an API without a clear runtime warning or confirmation at the moment of transmission. In a messaging automation context, this is especially dangerous because users may assume processing is local while sensitive conversations are silently disclosed to another service.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The auto-processing workflow can send replies automatically to contacts without a confirmation step. In a messaging tool, unintended outbound messages can cause privacy leaks, reputational damage, spam, or social engineering if the upstream AI or contact selection behaves unexpectedly.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The documentation advertises chat-history extraction and automated messaging/reply functions but does not prominently warn about consent, confidentiality, or the risk of sending replies on behalf of a user. In a messaging context, these features can expose private conversations and cause unauthorized or inappropriate outbound communications if misused or misconfigured.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
Requesting macOS accessibility and screen-recording permissions without emphasizing their sensitivity understates the security implications of granting broad control and visibility over the desktop. These permissions can expose message contents, other application windows, and allow automated input, so users need clear notice to make an informed decision.

Ssd 3

High
Confidence
96% confidence
Finding
The workflow explicitly collects newly observed chat messages and prepares them for submission to an AI service. This is sensitive conversational data handling, and in the context of a desktop chat automation skill it materially raises the danger because the data comes from personal or business messaging content.

Ssd 3

High
Confidence
99% confidence
Finding
The implementation combines copied chat messages into request payload data and posts them to a remote or local API. This is a direct exfiltration path for private communications and can expose confidential or regulated information if the destination is misconfigured, compromised, or untrusted.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal