wxwork-rpa

• Outcome: Review
• Latest audit: May 28, 2026 · 11:07 AM UTC
• Version: 1.0.1

Overview

This appears to be a real Enterprise WeChat automation skill, but it needs Review because it can read chats, send automated replies, mimic human behavior, and send chat content to a configured AI endpoint despite a local-only privacy claim.

Install only after confirming you are allowed to automate Enterprise WeChat and send chat content to the configured AI service. Use a trusted or local API endpoint, restrict the contact list and polling count, test with non-sensitive chats first, and treat the anti-detection behavior and automatic outbound replies as terms-of-service and compliance risks.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

startupinfo.wShowWindow = 1
                    CREATE_NO_WINDOW = 0x08000000

                    process = subprocess.Popen(
                        [wechat_path],
                        startupinfo=startupinfo,
                        shell=True,

• Confidence: 90% confidence
• Finding: process = subprocess.Popen( [wechat_path], startupinfo=startupinfo, shell=True, crea

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The document explicitly states that all operations are local and no data is uploaded, yet earlier sections describe calling an external AI API for automatic replies using CHAT_API_URL and CHAT_API_KEY. That contradiction can mislead users into exposing chat contents, contact data, or business communications to a third-party service without informed consent, which is especially risky in an enterprise messaging context.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: This module is explicitly designed for anti-detection, behavior variation, and human-behavior masquerading, including randomized delays, pattern switching, and simulated imperfections. In the absence of any legitimate stated purpose, these are classic evasion features that can help automation avoid detection, frustrate monitoring, and support abusive bot or fraud workflows.

Intent-Code Divergence

High

• Confidence: 88% confidence
• Finding: The module docstring presents the tool as a general WeChat desktop automation utility but omits that it can continuously poll chats, copy conversation contents, transmit them to an AI endpoint, and auto-reply. This deceptive or incomplete disclosure is dangerous because operators may run it without understanding the privacy and autonomy implications.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The comments imply the workflow checks for new messages before replying, but the implementation calls the AI API regardless of whether a new inbound message exists. This can cause unsolicited or repeated outbound messages and unintended disclosure of chat context to the configured endpoint.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The second auto-processing path repeats the same mismatch between stated behavior and actual behavior by unconditionally invoking the AI API. This increases the likelihood of autonomous responses and data transmission occurring when the user would reasonably expect silence.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The skill advertises AI API integration and automatic reply capabilities but does not clearly warn, at the point of use, that chat history or incoming messages may be sent to an external service. In a corporate WeChat automation tool, this omission creates a meaningful privacy and compliance risk because users may process sensitive internal conversations under the false impression that no data leaves the machine.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The code copies arbitrary text into the system clipboard without preserving prior clipboard contents or obtaining explicit user consent. Clipboard contents are globally accessible to other applications and may contain sensitive user data, so overwriting it can leak or destroy information and expose typed secrets to unrelated processes.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The function sends paste hotkeys to whichever application currently has focus, causing text injection into an external application without verification of the target. If focus changes unexpectedly, the code could paste commands, secrets, or destructive input into terminals, chats, admin consoles, or other sensitive contexts.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The module performs OS-level mouse and keyboard event injection, which gives it the ability to control the user's desktop and interact with other applications. In skill context, this is more dangerous because the code is designed specifically to simulate human behavior and drive external applications, which can be abused to trigger unintended actions, authorize prompts, or manipulate data outside the skill boundary.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The code copies chat content into the system clipboard and forwards message history to an external AI API without a clear consent flow or transmission warning. Clipboard contents can leak to other local processes, and external transmission may expose sensitive personal or business communications.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script can automatically send messages to contacts after UI automation without requiring a final user confirmation or presenting a prominent warning. This creates risk of accidental messaging, impersonation, and unintended communications at scale.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: This loop continuously polls contacts, extracts chat content, calls an AI service, and sends generated replies indefinitely with minimal safeguards. In context, that makes the tool materially more dangerous because it enables ongoing autonomous externalization of private conversations and automated outbound messaging.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The automated workflow is designed to collect private chat content and send it to an external AI service for response generation. In a messaging automation context, this is a real confidentiality risk because personal, customer, or corporate messages may be exported without sufficient controls or user awareness.

Ssd 3

High

• Confidence: 97% confidence
• Finding: The chat-history retrieval logic intentionally copies message contents from the UI into memory and returns them to the caller. That behavior is sensitive in itself because it enables bulk extraction of private communications from the desktop client, increasing exposure through logs, output channels, and downstream processing.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The CLI prints retrieved chat messages directly to stdout as JSON, which can expose sensitive conversation content in terminals, shell history, process monitors, logging pipelines, or captured job output. This creates an unnecessary secondary disclosure channel for private messages.

VirusTotal

No VirusTotal findings