wx

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:58 PM UTC
• Version: 1.0.0

Overview

This skill is a WeChat automation helper, but it can send real messages and capture screen content with too little confirmation, validation, and privacy control.

Review this before installing because it can act through your live WeChat desktop session. Only use it for messages you explicitly requested, avoid sensitive screen content before running OCR, and prefer a version that confirms the recipient and exact message before sending, restores the clipboard, captures only a selected chat region, and deletes temporary screenshots.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/wx_ocr_reply.py:12
• Finding: Full-Screen Capture Stored in a Predictable Temporary File<![CDATA[ ## Vulnerability Details **File Location**: `scripts/wx_ocr_reply.py`, lines 12-15 and 57-61 **Vulnerability Type**: Insecure temporary-file handling and excessive sensitive-data collection **Risk Level**: Medium ### Vulnerable Code ```python def take_screenshot(): """截图当前屏幕""" screenshot_path = "/tmp/wechat_screenshot.png" subprocess.run(["screencapture", "-x", screenshot_path]) return screenshot_path ``` ```python # 截图识别聊天内容 print("截图识别聊天内容...") screenshot = take_screenshot() chat_content = ocr_screenshot(screenshot) print("识别到的内容:") print(chat_content) ``` ### Technical Analysis The OCR workflow captures the entire screen rather than limiting capture to the intended WeChat window or conversation region. The screenshot is written to the fixed, predictable path `/tmp/wechat_screenshot.png`. The file is not securely created, its ownership and type are not validated, and it is never removed after OCR processing. Reusing a shared temporary-file name can expose the workflow to interference from another local process. Depending on operating-system behavior and permissions, another process may monitor, replace, or pre-create the path. Independently of such interference, the screenshot remains on disk and may contain unrelated sensitive information visible elsewhere on the screen. The recognized screen text is also printed to standard output, which can expose conversation content through terminal history, captured task logs, or automation logs. ### Attack Path 1. A user invokes `wx_ocr_reply.py` while WeChat and other sensitive applications or notifications are visible. 2. The script captures the entire display, including information outside the requested conversation. 3. The image is stored at the known path `/tmp/wechat_screenshot.png`. 4. A local process that monitors the predictable path, or another user with sufficient local access, retrieves or interferes with the screenshot. 5. The file remains available after OCR completes be ...[truncated 822 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Capture only the WeChat window or the smallest required conversation region instead of the full display. 2. Create the screenshot with a securely generated, user-private temporary path, such as through Python's `tempfile` module. 3. Open or create temporary files with restrictive permissions and validate that the destination is a regular file owned by the current user. 4. Place screenshot creation and OCR processing inside a `try`/`finally` block and delete the file in the `finally` block. 5. Avoid printing complete OCR output by default. Provide an explicit debug option and redact sensitive content before logging. 6. Check the return codes from `screencapture` and OCR subprocesses and fail closed if capture or processing fails. 7. Consider processing the image in memory where supported, eliminating persistent screenshot storage entirely. ]]>

T08 · Insecure Dependencies

Note

• Location: SKILL.md:138
• Finding: Unpinned Third-Party Dependency Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 138 **Vulnerability Type**: Unpinned software dependency and supply-chain exposure **Risk Level**: Low ### Vulnerable Code ```bash pip3 install pyautogui ``` ### Technical Analysis The installation instructions retrieve the latest available `pyautogui` release and its transitive dependencies without version constraints, a lockfile, or package-hash verification. Consequently, installation results can change over time even when the project itself is unchanged. No malicious dependency is confirmed in the audited project. However, the current instructions do not provide integrity controls against a compromised upstream release, unexpected dependency changes, or a future incompatible version. Python package installation and subsequent imports may execute package-controlled code with the privileges of the user performing the installation or running the scripts. ### Attack Path 1. A user follows the documented installation command. 2. `pip` resolves the current package and transitive dependency versions from the configured package index. 3. A compromised, unexpectedly changed, or otherwise unsafe resolved release is downloaded because no reviewed version or hash is enforced. 4. Package-controlled code can execute during installation or when imported by `wx_send.py` or `wx_ocr_reply.py`. 5. Such code runs with the privileges and data access of the invoking user. This path depends on compromise or unsafe modification of an upstream package or package source; the audit found no evidence that this has already occurred. ### Impact Assessment If a resolved package were compromised, it could execute arbitrary Python code as the installing or invoking user. That could expose files, environment variables, screen content, clipboard content, and resources available to that user. The dependency instruction does not independently provide administrator privileges unless the user installs it with elevate ...[truncated 17 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `pyautogui` and all transitive dependencies to reviewed versions. 2. Maintain a lockfile or requirements file generated from a trusted environment. 3. Require cryptographic package hashes, for example with `pip install --require-hashes`. 4. Install dependencies inside a dedicated virtual environment rather than the global Python environment. 5. Configure an approved package index and avoid untrusted mirrors. 6. Periodically scan and review pinned dependencies before updating them. 7. Document the tested Python and macOS versions to improve reproducibility. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/wx_send.py:19
• Finding: Messages Can Be Sent Without Verifying the Selected Recipient<![CDATA[ ## Vulnerability Details **File Location**: `scripts/wx_send.py`, lines 19-31; `scripts/wx_send.applescript.txt`, lines 15-31 and 33-52 **Vulnerability Type**: Unsafe UI automation and missing recipient validation **Risk Level**: Medium ### Vulnerable Code ```python # 输入联系人名称 pyautogui.write(contact_name) time.sleep(1.5) # 按回车进入聊天 pyautogui.press('return') time.sleep(1.5) # 输入消息 pyautogui.write(message) time.sleep(0.5) # 发送 pyautogui.press('return') ``` ```applescript tell application "System Events" tell process "WeChat" -- 打开搜索框 (Cmd+F) keystroke "f" using command down delay 1 -- 粘贴联系人名称 keystroke "v" using command down delay 2 -- 回车 keystroke return delay 1 -- 按一次下箭头 keystroke (ASCII character 31) delay 0.5 -- 按一次上箭头 keystroke (ASCII character 30) delay 0.5 -- 再次回车进入聊天 keystroke return delay 2 end tell end tell if messageText is not "" then set the clipboard to messageText tell application "System Events" tell process "WeChat" delay 1 -- 粘贴消息 keystroke "v" using command down delay 0.5 -- 发送 keystroke return end tell end tell return "Sent: " & messageText else return "Ready" end if ``` ### Technical Analysis Both implementations rely on fixed delays and simulated keystrokes. Neither implementation verifies that: - WeChat retained keyboard focus. - The search completed successfully. - The selected search result exactly matches the requested contact. - The active conversation is the intended recipient. - The message input control is focused before text is entered. - Sending completed in the expected conversation. Search-result ambiguity, slow UI rendering, application focus changes, or layout changes can therefore cause the message to be entered into and sent from an unintended context ...[truncated 1699 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Query accessibility attributes to confirm that WeChat is the foreground application and that the expected search or message control is focused. 2. Read and compare the active conversation title with the requested contact before entering the message. 3. Require an exact recipient match and abort when search results are missing or ambiguous. 4. Replace fixed sleeps with bounded waits for specific UI states. 5. Display the resolved recipient and request confirmation before sending sensitive messages. 6. Fail closed if any expected UI element, title, or state cannot be verified. 7. Separate message composition from message submission so validation occurs immediately before the final send action. 8. Report success only after verifying that the intended conversation remained active throughout the send operation. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (21)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill promises a dual-mode workflow including OCR-based auto-reply, but the shown core script only returns `Ready` when no message is provided and does not implement that capability. This mismatch can cause unsafe assumptions by users or upstream agents, leading them to rely on non-existent safeguards or workflows while still granting powerful automation permissions.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill promises a dual-mode workflow including OCR-based auto-reply, but the shown core script only returns `Ready` when no message is provided and does not implement that capability. This mismatch can cause unsafe assumptions by users or upstream agents, leading them to rely on non-existent safeguards or workflows while still granting powerful automation permissions.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The OCR auto-reply description omits key warnings that screenshots may capture unrelated on-screen sensitive information and that content may be transmitted to an external API. In the context of chat automation, this omission is especially risky because users may not realize personal messages, notifications, or other desktop data could be exposed.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill documents shell-executable automation (`osascript`, `python3`) but declares no explicit tool scope or permission boundary. In an agent environment, missing scope makes it easier for the skill to invoke local automation unexpectedly, including UI control and clipboard manipulation, without clear user consent or policy enforcement.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The manifest advertises built-in OCR auto-reply support, but the primary documented script does not do that. Security-sensitive capabilities must be accurately represented; otherwise, reviewers and users cannot correctly assess the data exposure and automation risks of the skill.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger description is broad enough that normal conversational requests about WeChat could invoke an automation that controls the UI and sends messages. In this context, accidental triggering is dangerous because the skill can modify the clipboard and dispatch messages to real contacts with limited user visibility.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill lacks an explicit warning that it will overwrite the clipboard and automate message sending through UI control. Clipboard replacement and simulated keystrokes can leak or destroy user data, and they may send content to the wrong chat if focus changes or UI state differs from expectations.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The documentation extends the skill into an OpenAI-powered OCR auto-reply workflow that goes beyond simple message sending. Expanding a skill's scope in documentation without corresponding manifest clarity and security warnings can lead to unreviewed data flows and over-privileged deployment.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: Introducing an external OpenAI API dependency for OCR auto-reply creates a potential exfiltration path for sensitive screen or chat content that is not necessary for the core task of sending a WeChat message. Because chat windows and screenshots may contain personal or confidential data, sending them to an external API materially increases privacy and compliance risk.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The top-level documentation says the script depends on OpenAI for generating replies, implying end-to-end OCR plus response generation. However, the code never imports or calls OpenAI and instead leaves reply generation as a TODO, which directly contradicts the documented behavior.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script captures the full screen and OCRs its contents without any explicit consent flow, minimization, or warning. In the context of a WeChat auto-reply skill, this is especially sensitive because the screenshot may include unrelated chats, credentials, notifications, or other confidential material beyond the intended conversation, creating a real privacy-exposure risk.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def take_screenshot():
    """截图当前屏幕"""
    screenshot_path = "/tmp/wechat_screenshot.png"
    subprocess.run(["screencapture", "-x", screenshot_path])
    return screenshot_path

def ocr_screenshot(image_path):

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

print("\\\\n".join(results))
'''
    
    result = subprocess.run([sys.executable, "-c", py_script], capture_output=True, text=True)
    return result.stdout

def main():

• Confidence: 79% confidence
• Finding: The script dynamically builds Python code as a string and executes it with `python -c`. Although it avoids a shell, `image_path` is interpolated directly into the generated code, so crafted input containing quotes/newlines could alter the executed Python source. In this file the current caller passes a fixed path, which reduces exploitability, but the pattern is still unsafe and brittle.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The manifest describes a mode that OCRs chat content and then automatically replies to the contact. In this file, the reply-generation and message-sending steps are explicitly left as TODOs and commented out, so the implemented behavior stops at displaying recognized text rather than completing the promised auto-reply flow.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This script automates WeChat UI actions and can send messages to a selected contact without any user-visible confirmation step before dispatch. It also overwrites the system clipboard with the contact name and message text, which can leak or destroy user clipboard contents and makes unintended or spoofed messaging easier if the skill is invoked with attacker-controlled input.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The manifest describes two modes: direct sending with provided content, and an OCR screenshot recognition mode that reads chat content and auto-replies when no message is supplied. This file implements only a simple two-argument send flow and exits when no message is provided, with no screenshot capture, OCR, or reply-generation logic.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script automatically focuses WeChat, selects a contact, types arbitrary input, and sends it immediately without any confirmation or preview. In an agent setting, this can cause unintended or unauthorized outbound messages, including social engineering, data leakage, or messages sent to the wrong recipient if UI focus/search results are not as expected.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def send_wechat_message(contact_name, message):
    """发送微信消息"""
    # 打开微信
    subprocess.run(['open', '-a', 'WeChat'])
    time.sleep(2)
    
    # 打开搜索框 (Cmd+F)

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def send_wechat_message(contact_name, message):
    """发送微信消息"""
    # 打开微信
    subprocess.run(['open', '-a', 'WeChat'])
    time.sleep(2)
    
    # 打开搜索框 (Cmd+F)

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Natural-Language Policy Violations

Low

• Confidence: 86% confidence
• Finding: The natural-language description is written only in Chinese ("发送微信消息给指定联系人"), which can indicate a language-specific constraint without any stated user choice or opt-in. The file provides no indication that the skill supports other languages or that the Chinese-only behavior is a justified locale-specific requirement.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The script automatically launches WeChat, focuses search, types a contact name, and sends keyboard input without a prominent disclosure or interactive confirmation. In this skill context, UI automation can cause unintended actions, target the wrong chat, or interfere with the user's active session, making the behavior riskier than ordinary local automation.

Static analysis

No suspicious patterns detected.