T08 · Insecure Dependencies
Warning
- Location
requirements.txt:1- Finding
Third-Party Dependencies Installed Without Artifact Integrity Verification
- Content
View full analysis
- Remediation
View remediation
Security audit
Wechat Control
Security checks for vulnerabilities and agentic risk
Overview
The skill does what it says, but it can send WeChat messages and reuse a cached login session with limited safeguards.
Install only if you are comfortable letting this skill act through your logged-in WeChat account. Use it in a private local environment, avoid sharing or syncing loginInfo.pkl, delete the cache when done, and review recipient plus message text carefully before running send commands.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
main.py:20- Finding
Reusable WeChat Authentication State Persisted Without Application-Level Protection
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill explicitly exposes the ability to enumerate recent chats and unread-message counts from a user's WeChat account, but the documentation does not clearly warn that this accesses private communication metadata. Even in a local-only workflow, chat names, last-message previews, and unread counts are sensitive and could be accessed or mishandled without informed user consent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The login flow enables
hotReload=True, which persists a reusable authenticated WeChat session on disk and reuses it automatically later. In a skill context, this weakens user awareness and consent around long-lived authentication state, and anyone with access to the host or cached session files may be able to act through the account without a fresh login.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This command sends arbitrary user-supplied text to an external WeChat recipient immediately, without a confirmation or clear disclosure that a real network action will occur. In an agent skill, this can be abused for unintended outbound messaging, social engineering, or exfiltration of sensitive data if higher-level tooling passes untrusted input into the command.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The listing function accesses account contacts and profile-like metadata and prints it directly, without warning the user that private account data will be retrieved and exposed to stdout. In an agent or automation environment, stdout may be logged, relayed, or consumed by other components, increasing the risk of unintended data disclosure.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The natural-language documentation and examples are entirely in Chinese, including user-facing invocation examples, without indicating that another language can be used or that the skill is intentionally limited to a Chinese-speaking context. This can violate a language/locale policy when no user opt-in or explicit locale justification is provided.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The unread-count command accesses account message metadata without notifying the user, which is a privacy-sensitive operation even if it returns only a count. While lower impact than message content or contact disclosure, it still exposes account state and may be invoked silently in an automated context.
- Content
Static analysis
No suspicious patterns detected.