T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/wx_ocr_reply.py:12- Finding
Full-Screen Capture Stored in a Predictable Temporary File
- Content
View full analysis
- Remediation
View remediation
Security audit
wx
Security checks for vulnerabilities and agentic risk
Overview
This skill is a WeChat automation helper, but it can send real messages and capture screen content with too little confirmation, validation, and privacy control.
Review this before installing because it can act through your live WeChat desktop session. Only use it for messages you explicitly requested, avoid sensitive screen content before running OCR, and prefer a version that confirms the recipient and exact message before sending, restores the clipboard, captures only a selected chat region, and deletes temporary screenshots.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T08 · Insecure Dependencies
Note
- Location
SKILL.md:138- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/wx_send.py:19- Finding
Messages Can Be Sent Without Verifying the Selected Recipient
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (21)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill promises a dual-mode workflow including OCR-based auto-reply, but the shown core script only returns
Readywhen no message is provided and does not implement that capability. This mismatch can cause unsafe assumptions by users or upstream agents, leading them to rely on non-existent safeguards or workflows while still granting powerful automation permissions.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill promises a dual-mode workflow including OCR-based auto-reply, but the shown core script only returns
Readywhen no message is provided and does not implement that capability. This mismatch can cause unsafe assumptions by users or upstream agents, leading them to rely on non-existent safeguards or workflows while still granting powerful automation permissions.- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The OCR auto-reply description omits key warnings that screenshots may capture unrelated on-screen sensitive information and that content may be transmitted to an external API. In the context of chat automation, this omission is especially risky because users may not realize personal messages, notifications, or other desktop data could be exposed.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill documents shell-executable automation (
osascript,python3) but declares no explicit tool scope or permission boundary. In an agent environment, missing scope makes it easier for the skill to invoke local automation unexpectedly, including UI control and clipboard manipulation, without clear user consent or policy enforcement.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The manifest advertises built-in OCR auto-reply support, but the primary documented script does not do that. Security-sensitive capabilities must be accurately represented; otherwise, reviewers and users cannot correctly assess the data exposure and automation risks of the skill.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger description is broad enough that normal conversational requests about WeChat could invoke an automation that controls the UI and sends messages. In this context, accidental triggering is dangerous because the skill can modify the clipboard and dispatch messages to real contacts with limited user visibility.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill lacks an explicit warning that it will overwrite the clipboard and automate message sending through UI control. Clipboard replacement and simulated keystrokes can leak or destroy user data, and they may send content to the wrong chat if focus changes or UI state differs from expectations.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The documentation extends the skill into an OpenAI-powered OCR auto-reply workflow that goes beyond simple message sending. Expanding a skill's scope in documentation without corresponding manifest clarity and security warnings can lead to unreviewed data flows and over-privileged deployment.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
Introducing an external OpenAI API dependency for OCR auto-reply creates a potential exfiltration path for sensitive screen or chat content that is not necessary for the core task of sending a WeChat message. Because chat windows and screenshots may contain personal or confidential data, sending them to an external API materially increases privacy and compliance risk.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The top-level documentation says the script depends on OpenAI for generating replies, implying end-to-end OCR plus response generation. However, the code never imports or calls OpenAI and instead leaves reply generation as a TODO, which directly contradicts the documented behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script captures the full screen and OCRs its contents without any explicit consent flow, minimization, or warning. In the context of a WeChat auto-reply skill, this is especially sensitive because the screenshot may include unrelated chats, credentials, notifications, or other confidential material beyond the intended conversation, creating a real privacy-exposure risk.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python def take_screenshot(): """截图当前屏幕""" screenshot_path = "/tmp/wechat_screenshot.png" subprocess.run(["screencapture", "-x", screenshot_path]) return screenshot_path def ocr_screenshot(image_path):
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 79% confidence
- Finding
The script dynamically builds Python code as a string and executes it with
python -c. Although it avoids a shell,image_pathis interpolated directly into the generated code, so crafted input containing quotes/newlines could alter the executed Python source. In this file the current caller passes a fixed path, which reduces exploitability, but the pattern is still unsafe and brittle.- Content
python print("\\\\n".join(results)) ''' result = subprocess.run([sys.executable, "-c", py_script], capture_output=True, text=True) return result.stdout def main():
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The manifest describes a mode that OCRs chat content and then automatically replies to the contact. In this file, the reply-generation and message-sending steps are explicitly left as TODOs and commented out, so the implemented behavior stops at displaying recognized text rather than completing the promised auto-reply flow.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This script automates WeChat UI actions and can send messages to a selected contact without any user-visible confirmation step before dispatch. It also overwrites the system clipboard with the contact name and message text, which can leak or destroy user clipboard contents and makes unintended or spoofed messaging easier if the skill is invoked with attacker-controlled input.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The manifest describes two modes: direct sending with provided content, and an OCR screenshot recognition mode that reads chat content and auto-replies when no message is supplied. This file implements only a simple two-argument send flow and exits when no message is provided, with no screenshot capture, OCR, or reply-generation logic.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script automatically focuses WeChat, selects a contact, types arbitrary input, and sends it immediately without any confirmation or preview. In an agent setting, this can cause unintended or unauthorized outbound messages, including social engineering, data leakage, or messages sent to the wrong recipient if UI focus/search results are not as expected.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python def send_wechat_message(contact_name, message): """发送微信消息""" # 打开微信 subprocess.run(['open', '-a', 'WeChat']) time.sleep(2) # 打开搜索框 (Cmd+F)
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python def send_wechat_message(contact_name, message): """发送微信消息""" # 打开微信 subprocess.run(['open', '-a', 'WeChat']) time.sleep(2) # 打开搜索框 (Cmd+F)
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The natural-language description is written only in Chinese ("发送微信消息给指定联系人"), which can indicate a language-specific constraint without any stated user choice or opt-in. The file provides no indication that the skill supports other languages or that the Chinese-only behavior is a justified locale-specific requirement.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The script automatically launches WeChat, focuses search, types a contact name, and sends keyboard input without a prominent disclosure or interactive confirmation. In this skill context, UI automation can cause unintended actions, target the wrong chat, or interfere with the user's active session, making the behavior riskier than ordinary local automation.
- Content