Security audit

wxwork-rpa

Security checks for vulnerabilities and agentic risk

Overview

This skill automates Enterprise WeChat messaging and needs Review because it can transmit chat history to arbitrary AI endpoints while its privacy text claims no network upload.

Install only if you are comfortable granting the tool control over the desktop session and exposing Enterprise WeChat message content to the configured AI endpoint. Before use, review the endpoint, avoid command-line API keys, expect local logs to contain sensitive data, and do not use the anti-detection or bulk/continuous messaging behavior in environments with compliance or platform-policy constraints.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (6)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/wechat.py:2505
Finding: Enterprise chat content and contact identities are transmitted to an unrestricted endpoint<![CDATA[ ## Vulnerability Details **File Location**: `scripts/wechat.py:2505-2546`, with call sites at `scripts/wechat.py:1902` and `scripts/wechat.py:2124` **Vulnerability Type**: Sensitive-data transmission to a caller-controlled network destination **Risk Level**: Critical ### Complete Code Snippet ```python def _call_ai_api(self, contact_name: str, customer_messages: List[Dict[str, Any]], api_url: str, api_key: str, model: str = "") -> List[Dict[str, Any]]: try: headers = { "Content-Type": "application/json", "Authorization": f"Bearer {api_key}" } data = { "model": model, "messages": customer_messages, "stream": False, "temperature": 0.7, "max_tokens": 1000 } data["user_id"] = None data["user_name"] = contact_name response = requests.post( api_url, json=data, headers=headers, timeout=30 ) ``` The data flow is invoked after chat messages are extracted: ```python ai_replies = self._call_ai_api( current_chat_name, chat_data, api_url, api_key, model ) ``` ### Technical Analysis The request body contains the extracted conversation in `messages` and the contact identity in `user_name`. The destination is supplied through `api_url` without a hostname allowlist, scheme restriction, destination validation, or user confirmation immediately before disclosure. Network transmission is necessary for the optional AI-reply feature, but unrestricted transmission is not the minimum privilege required. A secure implementation could constrain requests to explicitly trusted HTTPS endpoints and minimize or redact the data sent. The behavior also conflicts with the privacy statement in `SKILL.md:211-214`, which says that operations remain local and no data is uploaded. Users may therefore enable the feature without informed consent to the actual disclo ...[truncated 1092 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Permit only explicitly configured and reviewed HTTPS endpoints. 2. Validate the parsed URL, hostname, resolved addresses, port, and scheme before sending data. 3. Reject plaintext HTTP for non-loopback destinations and prevent unsafe redirects. 4. Display the exact destination and categories of data being sent, then require explicit consent. 5. Redact secrets, identifiers, and unnecessary historical messages before constructing the request. 6. Send only the minimum conversation context required for the requested reply. 7. Add enterprise DLP, retention, and audit controls. 8. Correct the documentation so it clearly states when conversation data leaves the device. 9. Consider a local-model mode for environments where enterprise messages cannot be disclosed externally. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: scripts/wechat.py:2520
Finding: API credentials can leak through command-line arguments, output, and plaintext transport<![CDATA[ ## Vulnerability Details **File Location**: `scripts/wechat.py:2520-2546`, `scripts/wechat.py:2748-2750`, and `scripts/wechat.py:2831` **Vulnerability Type**: Insecure secret handling and transport **Risk Level**: High ### Complete Code Snippet ```python headers = { "Content-Type": "application/json", "Authorization": f"Bearer {api_key}" } response = requests.post( api_url, json=data, headers=headers, timeout=30 ) ``` ```python parser.add_argument( '--api_url', default='http://localhost:8000/api/chat/completions', help='AI API URL' ) parser.add_argument( '--api_key', required='auto_process' in sys.argv, help='API key' ) ``` The original implementation also prints the first eight characters of the supplied key at `scripts/wechat.py:2831`. ### Technical Analysis The API key is passed as a command-line argument. Command lines can be retained in shell history and may be visible to process-monitoring software, endpoint-management agents, orchestration systems, crash reports, or other local users depending on the platform. Printing the first eight characters creates an additional credential disclosure. Prefixes are often sufficient to identify a specific key, correlate it across systems, or materially reduce the search space. The request destination accepts arbitrary schemes, including plaintext HTTP. If a non-loopback HTTP endpoint is selected, the complete Bearer token and conversation body can be observed or modified in transit. ### Attack Path 1. A user follows the documented example and places the API key in `--api_key`. 2. The shell records the command, or a process-monitoring system captures the process arguments. 3. The application prints an eight-character portion of the key to standard output, which may be collected centrally. 4. The user or another caller supplies an HTTP endpoint. 5. A network observer intercepts the Authorization header and conversation payload. 6. The observer reuses th ...[truncated 469 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `--api_key` and retrieve credentials from an operating-system secret store or protected environment variable. 2. Never print full or partial credential values. 3. Require HTTPS and normal certificate validation for every remote endpoint. 4. Reject insecure redirects and revalidate the destination after each redirect. 5. Use short-lived, narrowly scoped credentials. 6. Ensure exception messages, HTTP tracing, and diagnostics cannot log Authorization headers. 7. Document credential rotation and revocation procedures. 8. Warn users if process arguments or environment variables may be collected by their execution environment. ]]>

other

Error

Location: scripts/anti_detection.py:18
Finding: Normal automation paths actively implement behavioral detection evasion<![CDATA[ ## Vulnerability Details **File Location**: `scripts/anti_detection.py:18-176`, integrated at `scripts/wechat.py:825-979` **Vulnerability Type**: Behavioral detection evasion and human impersonation **Risk Level**: High ### Complete Code Snippet ```python def should_change_pattern(self) -> bool: current_time = time.time() if current_time - self.last_pattern_change > random.randint(1800, 3600): return True recent_activities = self._get_recent_activities(minutes=5) if len(recent_activities) > 50: return True return False ``` ```python pattern_config = self.anti_detection.get_pattern_config() move_duration = self.anti_detection.add_random_variation(move_duration) self.hardware_sim.simulate_mouse_move(x, y, move_duration) click_delay = pattern_config['click_delay'] time.sleep(self.anti_detection.get_safe_delay(click_delay)) ``` ```python if self.anti_detection.should_change_pattern(): new_pattern = self.anti_detection.get_next_pattern() self.current_behavior_mode = new_pattern typed_text = self.behavior_sim.simulate_typing_with_errors( text, pattern=self.current_behavior_mode ) self.hardware_sim.simulate_keyboard_input( typed_text, min_delay=min_delay, max_delay=max_delay ) ``` ### Technical Analysis The anti-detection modules are not unused utilities. They are invoked by standard click and typing functions. The code: - Randomizes click and typing timing. - Changes behavior patterns periodically and in response to activity volume. - Generates behavioral fingerprints. - Introduces deliberate typing mistakes and corrections. - Adds mouse jitter, hesitation, and human-like trajectories. - Records activity patterns for later behavioral variation. Random delays can sometimes improve UI reliability, but fingerprints, deliberate errors, pattern switching, and explicit anti-detection logic are not necessary for reliable Enterprise WeChat automation. Their purpose is to make automated ac ...[truncated 1118 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `AntiDetection` component and all detection-evasion terminology and behavior. 2. Remove behavioral fingerprints, deliberate mistakes, and activity-triggered pattern switching. 3. Use deterministic waits based on UI state rather than randomized human imitation. 4. Clearly identify automated activity where supported by the platform. 5. Add strict per-contact and global rate limits. 6. Require explicit confirmation before bulk or continuous processing. 7. Maintain tamper-resistant audit records of automated actions. 8. Enforce anti-spam controls and comply with Enterprise WeChat automation policies. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/hardware_simulator.py:31
Finding: Automatic HID enumeration and low-level system-wide input injection exceed least privilege<![CDATA[ ## Vulnerability Details **File Location**: `scripts/hardware_simulator.py:31-58` and `scripts/hardware_simulator.py:83-143`; initialized at `scripts/wechat.py:165` **Vulnerability Type**: Excessive device access and low-level input injection **Risk Level**: Medium ### Complete Code Snippet ```python def _init_windows_hid(self): try: import hid self.hid_device = None devices = hid.enumerate() for device in devices: if device['vendor_id'] == 0x1A2C or device['product_id'] == 0x6004: self.hid_device = hid.device() self.hid_device.open( device['vendor_id'], device['product_id'] ) break ``` ```python def simulate_mouse_move(self, x: int, y: int, duration: float = 0.5): try: if self.is_windows and hasattr(self, 'hid_device') and self.hid_device: self._windows_hid_mouse_move(x, y, duration) elif self.is_macos and hasattr(self, 'macos_available') and self.macos_available: self._macos_hid_mouse_move(x, y, duration) else: self._software_mouse_move(x, y, duration) ``` The capability is initialized for every main automation object: ```python self.hardware_sim = HardwareSimulator() ``` ### Technical Analysis Constructing `WeChatAutomation` automatically enumerates HID devices. The Windows selection condition matches when either a vendor ID or product ID matches, which is broader than matching a specific approved device pair. A matching device is opened without explicit user selection. The module also injects low-level keyboard and mouse events through Windows and macOS APIs. Such input is system-wide and applies to the current foreground application; it is not inherently scoped to Enterprise WeChat. Basic desktop automation may legitimately require accessibility input, but enumerating and opening physical HID devices is not required for the d ...[truncated 1048 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove HID enumeration and direct physical-device opening. 2. Use documented accessibility or UI Automation APIs scoped to the Enterprise WeChat process. 3. Verify process identity, window handle, title, and foreground focus immediately before every input action. 4. Abort all input if Enterprise WeChat loses focus. 5. Require explicit opt-in before enabling any low-level input backend. 6. If HID support is indispensable, match an exact approved vendor/product/serial tuple and present the selected device to the user. 7. Add a global emergency stop and PyAutoGUI-style fail-safe. 8. Initialize privileged input capabilities only for commands that actually need them. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/wechat.py:53
Finding: Sensitive contacts and message bodies are retained in plaintext logs and command output<![CDATA[ ## Vulnerability Details **File Location**: `scripts/wechat.py:53-60`, `scripts/wechat.py:1112-1184`, and `scripts/wechat.py:2780-2804` **Vulnerability Type**: Plaintext logging and output of enterprise communication data **Risk Level**: Medium ### Complete Code Snippet ```python logging.basicConfig( level=logging.INFO, format='%(asctime)s - %(name)s - %(levelname)s - %(message)s', handlers=[ logging.FileHandler('wechat_automation.log', encoding='utf-8'), logging.StreamHandler() ] ) ``` At `scripts/wechat.py:1112-1184`, multiple INFO-level statements interpolate both `contact_name` and the complete `message` into the configured handlers. The CLI also includes the message in its JSON result: ```python print(json.dumps({ 'success': True, 'contact': args.contact, 'message': args.message, 'result': 'Message sent successfully' }, ensure_ascii=False)) ``` The final string literal above is an English rendering of the original status text; the sensitive variable interpolation is unchanged. ### Technical Analysis INFO logs are sent both to a persistent plaintext file and standard output. Message bodies and contact identities are included in routine operation, rather than only in an explicitly enabled diagnostic mode. Standard output is frequently collected by shells, CI systems, task runners, endpoint agents, and centralized logging platforms. The log file has no explicit restrictive permissions, rotation, retention period, encryption, or redaction. The documentation mentions local logs but does not adequately disclose that message content and contact identities may be retained. ### Attack Path 1. A user sends a confidential message through `search_and_send`. 2. The Skill interpolates the contact name and full message into INFO-level log records. 3. The records are written to `wechat_automation.log` and the terminal stream. 4. A local user, backup agent, support bundle, or centralized log collector retr ...[truncated 583 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove message bodies, contact names, API keys, and conversation data from routine logs. 2. Record only non-sensitive event identifiers, success states, and aggregate counts. 3. Apply centralized structured redaction before records reach any handler. 4. Make sensitive diagnostics explicitly opt-in and disabled by default. 5. Create log files with restrictive user-only permissions. 6. Implement rotation, short retention, and secure deletion. 7. Avoid returning full message bodies in CLI JSON unless explicitly requested. 8. Document all local and external logging behavior in the privacy section. ]]>

T08 · Insecure Dependencies

Warning

Location: SKILL.md:16
Finding: Unpinned and incomplete dependency installation instructions create supply-chain exposure<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:16-24` **Vulnerability Type**: Unpinned third-party dependencies **Risk Level**: Medium ### Complete Code Snippet ```bash pip install pyautogui pillow opencv-py numpy pyperclip requests psutil paddle pip install pywin32 pip install pyobjc-framework-Quartz pyobjc-core pyobjc ``` ### Technical Analysis The instructions install packages without exact versions or cryptographic hashes. As a result, installation behavior can change over time and depends on the package-index state when the user executes the commands. The documented dependency set also does not fully correspond to imports observed in the code, including `uiautomation`, `paddleocr`, and `hid`. Users may therefore install additional packages ad hoc, increasing the likelihood of package-name mistakes or unreviewed components. No specific malicious dependency was identified during this audit. The finding concerns the absence of reproducible dependency controls and the elevated consequences of a future compromised, substituted, or incompatible release. ### Attack Path 1. A user follows the documentation and runs the unpinned `pip install` commands. 2. The package resolver selects the versions currently available from configured indexes. 3. A compromised release, malicious index mirror, dependency-confusion package, or mistaken package name is selected. 4. Package installation or import executes attacker-controlled code. 5. That code runs in an environment granted clipboard, screen-recording, accessibility, messaging, and potentially HID access. ### Impact Assessment A compromised dependency would inherit the privileges of the Python process. In this project, those privileges may include reading the screen and clipboard, injecting keyboard and mouse events, reading Enterprise WeChat conversations, sending messages, and accessing API credentials. The precise impact depends on the user's account privileges and the permissions granted t ...[truncated 28 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Provide a reviewed lock file containing exact versions for all direct and transitive dependencies. 2. Generate and verify package hashes with `pip --require-hashes`. 3. Ensure every imported package is explicitly documented and pinned. 4. Verify package names against their authoritative publishers. 5. Remove unused dependencies and minimize the dependency graph. 6. Install in an isolated virtual environment under a non-administrative account. 7. Use a controlled internal package index or allowlisted registry where appropriate. 8. Add automated vulnerability, provenance, and license scanning to release workflows. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Behavioral ASTexec() Call, eval() Call, Dynamic Import

Findings (34)

Missing User Warnings

High

Confidence: 96% confidence
Finding: The documented automatic reply workflow integrates with a custom AI API, which necessarily implies sending chat content off-host, yet the skill later asserts that no data is uploaded to the network. In the context of enterprise WeChat automation and chat-history extraction, this inconsistency is dangerous because users may unknowingly route potentially sensitive corporate messages to external systems.

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: The skill claims in its privacy/security section that 'all operations are completed locally' and that no data is uploaded to the network, but elsewhere documents an auto-reply feature that requires an external AI API. This can mislead users into exposing chat contents, contact data, or sensitive business communications to a third-party service under false privacy assumptions.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: This module is explicitly designed for anti-detection, behavior randomization, and human-like disguise, including pattern switching, fingerprint generation, randomized delays, and simulated mistakes. In the absence of any legitimate declared purpose, these capabilities strongly indicate an attempt to evade monitoring or abuse detection systems, which materially increases the ability of an automated agent to conceal unauthorized activity.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The module presents itself as a desktop automation tool, but it also contains autonomous polling and AI-driven replying behavior. That mismatch is dangerous because operators may grant trust and permissions for simple UI automation without realizing the tool can continuously monitor conversations and act on their behalf.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The advertised feature list omits that chat content is sent to an external AI endpoint. This creates a transparency and consent failure around sensitive communications, increasing the chance of unintentional privacy breaches and unsafe deployment.

Tool Parameter Abuse

High

Category: Tool Misuse
Content: startupinfo.wShowWindow = 1 CREATE_NO_WINDOW = 0x08000000 process = subprocess.Popen( [wechat_path], startupinfo=startupinfo, shell=True,
Confidence: 90% confidence
Finding: This duplicate finding points to the same risky pattern: shell-enabled process creation for launching the desktop client. The main issue is unnecessary shell participation, which broadens attack surface and weakens trust in the launched binary path.

Tool Parameter Abuse

High

Category: Tool Misuse
Content: startupinfo.wShowWindow = 1 CREATE_NO_WINDOW = 0x08000000 process = subprocess.Popen( [wechat_path], startupinfo=startupinfo, shell=True,
Confidence: 90% confidence
Finding: This duplicate finding points to the same risky pattern: shell-enabled process creation for launching the desktop client. The main issue is unnecessary shell participation, which broadens attack surface and weakens trust in the launched binary path.

Ssd 3

High

Confidence: 98% confidence
Finding: The autonomous workflow collects chat content and forwards it to an AI service for reply generation, creating a direct path for sensitive conversational data to leave the messaging client. Because the system acts on natural-language content, malicious or sensitive instructions embedded in chats may influence downstream behavior or cause oversharing.

Ssd 3

High

Confidence: 99% confidence
Finding: The code packages chat history directly into the AI request payload as `messages`, preserving raw user-provided content. This creates sustained semantic exposure of potentially confidential communications and increases the risk that sensitive instructions or data are retained, logged, or mishandled by the receiving service.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The script sends chat history and message contents to an external AI API without any confirmation at the transmission point. In the context of enterprise chat automation, this can leak sensitive personal or business information to a local or remote service without informed consent.

Whitespace Padding

Medium

Category: Prompt Injection
Content: ## 命令参考 | 命令 | 功能 | 示例 | |------|--------------|--------------------------------------------------------------------------------------------------------| | `start` | 启动企业微信客户端 | `wechat.py start` | | `activate` | 激活并最大化企业微信窗口 | `wechat.py activate --title 企业微信` |
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

Category: Prompt Injection
Content: | 命令 | 功能 | 示例 | |------|--------------|--------------------------------------------------------------------------------------------------------| | `start` | 启动企业微信客户端 | `wechat.py start` | | `activate` | 激活并最大化企业微信窗口 | `wechat.py activate --title 企业微信` | | `search_and_send` | 搜索联系人并发送消息 | `wechat.py search_and_send --contact 张三 --message 您好` | | `get_history` | 获取指定联系人聊天记录 | `wechat.py get_history --contact 李四 --limit 15` |
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

Category: Prompt Injection
Content: | `get_history` | 获取指定联系人聊天记录 | `wechat.py get_history --contact 李四 --limit 15` | | `auto_process` | 自动轮询联系人并智能回复 | `wechat.py auto_process --polling_times 10 --api_key xxx --api_url xxx --model xxx --contact_list xxx` | | `stop_auto_process` | 停止自动回复 | `wechat.py stop_auto_process` | | `help` | 查看帮助信息 | `wechat.py help` | ## 核心功能说明
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The module docstring and class docstring are written entirely in Chinese, and log/messages throughout the file continue that language choice. For a general-purpose skill file, this imposes a specific language without any opt-in or documented region-specific justification, which matches the language/locale policy violation criteria.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The module docstring explicitly claims '反检测策略' (anti-detection strategies), which suggests functionality aimed at evading detection systems. However, the code implements only behavioral simulation primitives such as randomized delays, mouse trajectories, and typing errors, with no actual detection-evasion logic. This is an active mismatch between stated intent in documentation and implemented behavior.

Natural-Language Policy Violations

Medium

Confidence: 87% confidence
Finding: The module docstring and surrounding user-facing natural-language text are entirely in Chinese, with no indication that other languages are supported or that the language choice is intentional and documented. Under the stated policy, forcing or implicitly requiring a specific language without user opt-in can be a locale-policy violation.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The top-level documentation describes the module as 'hardware-layer simulation' using HID devices directly. In practice, the implementation explicitly falls back to pyautogui mouse movement and keyboard input, and for text entry it uses clipboard copy/paste via pyperclip plus hotkeys when HID support is unavailable or for certain text cases, which is materially different from direct HID simulation.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The code can take control of the active desktop session and generate system-wide mouse and keyboard events without user confirmation, visibility controls, or scope restriction. In an agent skill context, this is dangerous because any caller able to reach these methods can drive arbitrary UI actions in other applications, potentially causing unauthorized clicks, form submission, or command execution.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The docstring for simulate_keyboard_input says it performs hardware-level keyboard input simulation. However, the code routes to _software_keyboard_input on unsupported platforms/failures, and even the Windows path switches to clipboard-based paste for Chinese or long text, so the stated intent contradicts the actual behavior for significant cases.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: This path overwrites the system clipboard with arbitrary text and pastes it into the active application without preserving prior clipboard contents or notifying the user. That can leak or destroy sensitive clipboard data and can also inject attacker-controlled content into privileged or unintended destinations if the focus is on another window.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The Windows-specific path copies long or Chinese text to the clipboard and issues Ctrl+V globally, again without consent, destination validation, or clipboard preservation. In an automation skill, this makes unintended cross-application injection more dangerous because the active window may not be the intended target, especially if focus changes during execution.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The imports for `HardwareSimulator`, `BehaviorSimulator`, and `AntiDetection` indicate deliberate stealth and human-behavior mimicry. In a messaging automation context, anti-detection logic is suspicious because it is not needed for legitimate local automation and instead suggests evasion of platform safeguards or monitoring.

subprocess module call

Medium

Category: Dangerous Code Execution
Content: # 尝试在PATH中查找 if IS_WINDOWS: try: result = subprocess.run(['where', 'WXWork.exe'], capture_output=True, text=True, encoding='gbk', creationflags=subprocess.CREATE_NO_WINDOW) if result.stdout:
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

Category: Dangerous Code Execution
Content: startupinfo.wShowWindow = 1 CREATE_NO_WINDOW = 0x08000000 process = subprocess.Popen( [wechat_path], startupinfo=startupinfo, shell=True,
Confidence: 88% confidence
Finding: This launches a process with `shell=True`, which increases attack surface and can cause unexpected shell interpretation on Windows. Although `wechat_path` is derived from local discovery rather than direct user input, using the shell for executable launch is unnecessary and unsafe, especially in an automation tool that may run with user privileges.

subprocess module call

Medium

Category: Dangerous Code Execution
Content: # macOS启动 self.logger.info("macOS启动微信") try: subprocess.run(['open', '-a', 'WXWork'], capture_output=True, text=True, timeout=10) self.logger.info("使用open命令启动微信") except Exception as e:
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.