T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/collector.py:397- Finding
Automatic collection and plaintext retention of all WeChat sessions
- Content
View full analysis
- Remediation
View remediation
Security audit
Wx Echo
Security checks for vulnerabilities and agentic risk
Overview
This skill has a coherent WeChat-to-Discord assistant purpose, but it requests broad access to decrypted private chats, stores sensitive keys and messages locally, and creates recurring external posting workflows with weak scoping controls.
Install only if you are comfortable granting the agent access to decrypted WeChat history and letting it post chat-derived content to Discord on a schedule. Before use, restrict monitored chats up front, disable raw source excerpts by default, avoid SSH passwords and curl token fallbacks, use a private work directory with owner-only permissions, keep all_keys.json and collector.db out of backups/shared folders, and review Discord posts before publishing sensitive work or personal content.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (6)
T09 · Insecure Skill Coding Practices
Error
- Location
prompts/todo-scan.md:10- Finding
SSH passwords are persisted in prompts and host verification is disabled
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/decrypt/find_all_keys_macos.c:263- Finding
Recovered WeChat database keys are printed and stored without enforced restrictive permissions
- Content
View full analysis
- Remediation
View remediation
T01 · Skill Instruction Hijacking
Error
- Location
prompts/todo-scan.md:35- Finding
Untrusted WeChat messages can influence a tool-enabled scheduled Agent
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
scripts/requirements.txt:1- Finding
Third-party dependencies are installed without version or integrity pinning
- Content
View full analysis
- Remediation
View remediation
other
Warning
- Location
prompts/todo-scan.md:109- Finding
Private chat content and identities are transmitted to external model and Discord services
- Content
View full analysis
Relevant conversation content... ``` The fallback directly sends the generated content to Discord: ```bash curl -s -X POST "https://discord.com/api/v10/channels/{{forum_id}}/threads" \ -H "Authorization: Bot $DISCORD_BOT_TOKEN" \ -H "Content-Type: application/json" \ -d '{"name":"Post title","applied_tags":["tag_id"],"message":{"content":"Post content"}}' ``` The README additionally states that extracted chat content is sent to the configured model API during AI analysis. ### Technical Analysis The feature intentionally transfers chat-derived information outside WeChat and the local machine. Todo and Calendar posts may contain contact names, event details, timestamps, locations, and direct conversation excerpts. Digest posts include group names, sender names, quotations, and links. Although these external transfers support the declared functionality and the model transfer is disclosed in the README, the project does not implement consent controls, automatic redaction, sensitivity classification, or per-conversation publication approval. Other participants in the source conversations may not expect their messages or identities to be processed by a model provider or reproduced on Discord. ### Attack Path 1. A contact sends private or sensitive information through WeChat. 2. The collector stores the message locally. 3. An extraction script sends the content into the Agent/model analysis context. 4. The mod ...[truncated 734 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (57)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill's stated purpose is to scan private WeChat chats and work groups for schedule data, create calendar entries, and forward results to Discord. Processing private communications and exporting derived content to another platform without a clear consent notice, minimization rules, or privacy warning creates a substantial privacy and compliance risk.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The instructions explicitly tell the agent to post source contact identities and conversation excerpts from private WeChat messages into Discord threads. That is a direct cross-system disclosure of sensitive personal and workplace communications, and the context makes it more dangerous because the excerpts may contain confidential details unrelated to scheduling.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill directs the agent to execute Python commands over SSH using password-based authentication with StrictHostKeyChecking disabled. For a digest-generation workflow, this grants unnecessary remote code execution capability and removes host authenticity verification, creating risks of credential theft, machine-in-the-middle interception, and execution on an impersonated host.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The core task is to extract todos from private WeChat chats and push updates to Discord whenever changes occur, establishing a persistent automated data-transfer pipeline. That standing pipeline significantly increases the likelihood of continuous privacy leakage, especially because the conversations may contain sensitive personal, legal, or financial content.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill processes private WeChat conversations and pushes derived todos to Discord, but the prompt contains no user-facing warning, consent step, or privacy boundary explanation. This creates a silent cross-platform data flow from private chats to a third-party service, which can expose sensitive personal or business information.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
This section operationalizes disclosure by instructing the agent to publish todo details plus source chat excerpts into Discord forum threads. Because the source material is private natural-language communication, this creates a direct exfiltration path of user-provided content to a third-party environment.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The instructions tell the agent to include source conversation excerpts in Discord posts, which directly republishes private chat content outside the original channel. Without a warning or consent control, this can disclose confidential details, names, deadlines, financial topics, or legal matters to unintended viewers in Discord.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This code uses task_for_pid to attach to a live WeChat process and read its memory in order to recover SQLCipher keys, but it provides no explicit warning about the sensitivity of extracted credentials or the legal/security implications of dumping process memory. Because the tool is specifically designed to extract encryption keys from another process, the surrounding skill context makes this substantially more dangerous than a generic debugger utility.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Recovered encryption keys are persisted to all_keys.json in plaintext, creating a durable secret store on disk that can be copied, backed up, or read by other local users and tools. For a program that extracts database decryption keys from memory, writing those keys to disk without strong warnings or protections materially increases compromise risk.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The user-facing invocation examples are written only in Chinese, such as the text users are told to send to their agent. This can constitute a language policy issue because the skill presents a fixed interaction language without stating that other languages are supported or letting the user opt in.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The README encourages users to let an agent perform cloning, compilation, key extraction from process memory, decryption, synchronization, and cron-style registration with 'just follow the agent' guidance. This is dangerous because it normalizes delegating high-risk, persistent, and privacy-sensitive actions without informed consent, especially in a skill that accesses encrypted chat databases and installs recurring tasks.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
Line L045 states that the CLI '只做数据提取' (only does data extraction), which is contradicted by other documented behavior in the same file: L019 says the agent will compile tools, extract keys, decrypt, sync, and register cron jobs, and L086 describes a collector script that syncs messages into a database. This is an active documentation-level contradiction about the scope of what the skill does.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 94% confidence
- Finding
The README states that sudo is required for extracting WeChat keys from process memory, which is an inherently high-risk operation. Granting elevated privileges to install or run a skill that reads another application's memory materially increases the blast radius of misuse, compromise, or implementation mistakes, particularly given the private-message context.
- Content
md - **macOS 13+**（ARM64 或 Intel） - **微信桌面版 4.0+** 正在运行 - **Python 3.8+** + `pip3 install pycryptodome zstandard pyyaml` - **sudo 权限**（仅密钥提取需要） - **[OpenClaw](https://openclaw.ai)** ---
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
The README instructs users to rerun a sudo-based key extraction command whenever WeChat restarts, normalizing repeated privileged memory access as part of routine operation. In the context of a skill that processes personal chat data and installs automation, this increases the likelihood of unsafe habituation and repeated exposure of sensitive secrets under elevated privileges.
- Content
md | 级别 | 问题 | 说明 | |------|------|------| | 🔴 | 微信重启后密钥失效 | 需重新 `sudo find_all_keys_macos` | | 🟡 | Windows 密钥提取 | 基础编码兼容已完成，密钥提取待适配 | | 🟡 | 首次同步慢 | 历史消息多时几分钟，可 `--chatroom` 分批 | | 🟡 | DB 结构差异 | 已兼容多种列名，可能有遗漏 |
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Line L030 characterizes the scripts layer as limited to data extraction, which implies a narrower, lower-impact role. Elsewhere the same document shows that this layer includes key extraction, full database decryption, and WAL patching, which is materially different from merely extracting data to JSON.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 91% confidence
- Finding
The skill directs the user to run a locally compiled key-extraction binary under
sudo, granting elevated privileges to code from the skill package. Because the binary is intended to extract WeChat database keys from a running process, it handles highly sensitive material and expands the blast radius if the source or compiled artifact is malicious, tampered with, or simply unsafe.- Content
bash cd <work_dir> sudo <skill_dir>/scripts/decrypt/find_all_keys_macos # 输出 all_keys.json 到当前目录
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill introduces an
ssh_passwordplaceholder and explicitly suggests use with sshpass, which encourages storing or injecting a reusable SSH password into prompts, cron jobs, or agent configuration. That can expose credentials via logs, process listings, persisted task definitions, or prompt history, especially in an automation system that regularly executes scheduled tasks.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This manifest/config template uses Chinese-only natural-language instructions throughout, which imposes a specific language on users without any opt-in or alternative. The policy explicitly allows locale constraints only when documented and justified, which is not present here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
All operational instructions, examples, and content templates are provided only in Chinese, with no option for another language or note that the skill is intentionally region-specific. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill explicitly directs password-based SSH command execution, including running Python and osascript remotely on another host. This gives the agent remote execution capability beyond simple data processing and can be abused to run arbitrary commands on a trusted machine, especially because the command string is templated and the host key check is disabled.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The prompt instructs the agent to bypass the normal messaging tool and directly call the Discord API with a bot token if the preferred path fails. This expands the skill's effective privileges, enables direct external transmission of extracted message/calendar content, and increases the risk of secret misuse or exfiltration outside declared tool boundaries.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The fallback instructions combine credential use via a Discord bot token with transmission of schedule and message-derived content to an external service, but the prompt does not clearly warn users about this data flow. This increases the chance of unintended disclosure of sensitive personal or workplace information and mishandling of secrets.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
This line performs a direct POST to Discord's API carrying thread content derived from private chats. In context, the external transmission is not just generic networking; it exports potentially sensitive calendar and message data to a third party, making unauthorized disclosure a realistic risk.
- Content
md > > ⚠️ 如果 `message(action=thread-create)` 报错，改用 `exec` 执行 curl： > ```bash > curl -s -X POST "https://discord.com/api/v10/channels/{{forum_id}}/threads" \ > -H "Authorization: Bot $DISCORD_BOT_TOKEN" \ > -H "Content-Type: application/json" \ > -d '{"name":"帖子标题","applied_tags":["tag_id"],"message":{"content":"帖子内容"}}'
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill is designed to extract WeChat group messages, analyze them, and repost summaries to Discord, but it provides no warning, consent check, or filtering requirements for sensitive or private content. In this context, the absence of explicit data-handling safeguards materially increases the risk of unauthorized disclosure of chat content to another platform.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The fallback tells the agent to use exec with curl and a bot token to call the Discord API directly. This expands the skill from a scoped forum-posting operation to arbitrary authenticated network access, bypassing tool-level guardrails and increasing the chance of credential misuse or broader API abuse.
- Content
Static analysis
No suspicious patterns detected.