wechat-auto-reply-skill-v5

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:48 AM UTC
• Version: 5.0.0

Overview

This skill’s WeChat auto-reply purpose is understandable, but it grants persistent private-message monitoring and message-sending authority with weak recipient checks and unsafe dependency/process handling.

Review carefully before installing. Use only with non-sensitive chats, do not enable auto-send unless you can tolerate wrong-recipient messages, avoid the Windows `npx` fallback, and prefer a review-before-send workflow with explicit contact verification and a precise stop command.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T08 · Insecure Dependencies

Error

• Location: scripts/wechat_monitor.py:130

Finding

Unpinned Third-Party Package Execution Through NPX Fallback

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/wechat_monitor.py:136

Finding

Full-Screen Capture Stored at a Predictable Temporary Path

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/wechat_monitor.py:260

Finding

Configured Contact Is Not Verified Before Detection or Message Transmission

Content

View full analysis

args.threshold: write_pending(pending_path, latest, contact) prev_size = cur_size else: prev_size = cur_size ``` The corresponding Windows reply procedure in `SKILL.md:319-328` only switches to WeChat, types the reply, and presses Enter. It does not select or verify the configured contact before sending. ### Technical Analysis The `--contact` argument is only copied into log and pending-file metadata. It is not used to: - Select the configured contact. - Confirm the title or identity of the open conversation. - Restrict screenshot analysis to that contact. - Validate the recipient immediately before sending. Change detection is based solely on the difference between screenshot file sizes. Any visual change can therefore create a pending event, including activity in another chat, window movement, notifications, animation, or unrelated desktop changes on Windows. The reply automation then focuses WeChat and sends text to whichever conversation currently owns the input field. This contradicts the documented assertion that the Skill only replies to the target contact. ### Attack Path 1. The monitor is configured for contact A. 2. Contact B's conversation is active, or the user switches to it after monitor ...[truncated 1129 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:404

Finding

Documented Stop Procedure Force-Terminates Unrelated Python Processes

Content

View full analysis

rm -rf /tmp/wechat_mon /tmp/wechat_pending.txt ``` ```powershell Stop-Process -Name python -Force -ErrorAction SilentlyContinue Remove-Item -Recurse -Force "$env:TEMP\wechat_mon" Remove-Item -Force "$env:TEMP\wechat_pending.txt" ``` The same Windows termination instruction is repeated in `USAGE.md:282-292`. ### Technical Analysis The Windows stop command selects processes solely by the generic executable name `python` and forcefully terminates all matching processes. It does not verify: - The process identifier created by this Skill. - The script path. - The command-line arguments. - The process owner or start time. - Whether the process is the WeChat monitor. As a result, unrelated Python applications running in the same accessible process scope can be terminated. The macOS command is narrower because it searches for `wechat_monitor.py`, but it still terminates every matching monitor rather than the specific process created by a particular Skill invocation. It may therefore stop monitors associated with other contacts or users of the same account. ### Attack Path 1. The user has one or more unrelated Python workloads running. 2. The user follows the documented procedure to stop the WeChat monitor. 3. PowerShell resolves every accessible process named `python`. 4. `Stop-Process` applies forced termination to all matches. 5. Unrelated services, scripts, development sessions, or data-processing jobs terminate without graceful cleanup. 6. Unsaved state or partially written data may be lost or corrupted. ### Impact Assessment The command does not obtain new privileges, but it uses the Skill's existing process-control authority beyond the legitimate target. Potential impact includes: - Denial ...[truncated 465 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (34)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill claims to monitor specific contacts and auto-reply safely, but the described mechanism relies on screenshots/window-state heuristics and does not robustly verify the actual message sender before replying. In a messaging context, this mismatch is dangerous because it can cause replies to the wrong person, leak private information, or act on misdetected UI state while presenting itself as targeted automation.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 407)May include surrounding context.

bash

kill $(pgrep -f wechat_monitor.py)
rm -rf /tmp/wechat_mon /tmp/wechat_pending.txt

Windows 额外操作

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · USAGE.md (reported line 270)May include surrounding context.

bash

kill $(pgrep -f wechat_monitor.py)
rm -rf /tmp/wechat_mon /tmp/wechat_pending.txt

Windows 额外操作

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 407)May include surrounding context.

bash

kill $(pgrep -f wechat_monitor.py)
rm -rf /tmp/wechat_mon /tmp/wechat_pending.txt

Windows 额外操作

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · USAGE.md (reported line 270)May include surrounding context.

bash

kill $(pgrep -f wechat_monitor.py)
rm -rf /tmp/wechat_mon /tmp/wechat_pending.txt

Windows 额外操作

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 407)May include surrounding context.

bash

kill $(pgrep -f wechat_monitor.py)
rm -rf /tmp/wechat_mon /tmp/wechat_pending.txt

Windows 额外操作

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · USAGE.md (reported line 270)May include surrounding context.

bash

kill $(pgrep -f wechat_monitor.py)
rm -rf /tmp/wechat_mon /tmp/wechat_pending.txt

Windows 额外操作

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This section describes launching a background monitor and creating an automatic reply workflow that analyzes screenshots and sends WeChat messages, but it does not prominently warn about privacy, consent, mis-send risk, or account/platform policy implications. Because the skill captures message content from the screen and impersonates the user in replies, the lack of explicit risk disclosure makes unsafe deployment much more likely.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

The combined command rm -rf /tmp/wechat_mon /tmp/wechat_pending.txt encourages forced deletion of skill artifacts without guardrails such as existence checks, path validation, or warnings. In context this is less severe than arbitrary command injection, but it still normalizes unsafe shell patterns and could cause unintended deletion if the temp paths are manipulated or misread.

Content

Scanner excerpt · 微信自动回复使用说明_v5.txt (reported line 160)May include surrounding context.

text

停止微信监控
macOS 额外操作
kill $(pgrep -f wechat_monitor.py)
rm -rf /tmp/wechat_mon /tmp/wechat_pending.txt
Windows 额外操作
Stop-Process -Name python -Force -ErrorAction SilentlyContinue
Remove-Item -Recurse -Force "$env:TEMP\wechat_mon"

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 86% confidence

Finding

The combined command rm -rf /tmp/wechat_mon /tmp/wechat_pending.txt encourages forced deletion of skill artifacts without guardrails such as existence checks, path validation, or warnings. In context this is less severe than arbitrary command injection, but it still normalizes unsafe shell patterns and could cause unintended deletion if the temp paths are manipulated or misread.

Content

Scanner excerpt · 微信自动回复使用说明_v5.txt (reported line 160)May include surrounding context.

text

停止微信监控
macOS 额外操作
kill $(pgrep -f wechat_monitor.py)
rm -rf /tmp/wechat_mon /tmp/wechat_pending.txt
Windows 额外操作
Stop-Process -Name python -Force -ErrorAction SilentlyContinue
Remove-Item -Recurse -Force "$env:TEMP\wechat_mon"

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

The combined command rm -rf /tmp/wechat_mon /tmp/wechat_pending.txt encourages forced deletion of skill artifacts without guardrails such as existence checks, path validation, or warnings. In context this is less severe than arbitrary command injection, but it still normalizes unsafe shell patterns and could cause unintended deletion if the temp paths are manipulated or misread.

Content

Scanner excerpt · 微信自动回复使用说明_v5.txt (reported line 160)May include surrounding context.

text

停止微信监控
macOS 额外操作
kill $(pgrep -f wechat_monitor.py)
rm -rf /tmp/wechat_mon /tmp/wechat_pending.txt
Windows 额外操作
Stop-Process -Name python -Force -ErrorAction SilentlyContinue
Remove-Item -Recurse -Force "$env:TEMP\wechat_mon"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README documents continuous screenshot capture of WeChat windows and automatic message sending, but it does not clearly warn users about the privacy implications of capturing chat content or the account and consent risks of automated replies. In this skill context, the behavior is directly tied to a personal messaging application, making accidental surveillance, disclosure of sensitive conversations, or unintended automated actions more dangerous than generic desktop automation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill invokes shell commands, reads environment variables, and writes files/logs, but it does not declare any explicit tool scope such as allowed-tools or permissions. That makes the operational boundary unclear and increases the chance an agent will execute broader host actions than users expect, especially given the many shell-based setup, monitoring, and cleanup steps.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill enables ongoing monitoring and auto-reply of private WeChat messages but does not present a prominent warning about the privacy and autonomy implications before activation. In this context, lack of informed consent is risky because users may not realize the agent will continuously inspect conversations and send messages on their behalf.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs the agent to read private chat content and imitate the user's voice in outbound messages. In a messaging skill, this is sensitive because it combines access to private communications with impersonation, increasing the chance of privacy violations, social engineering, and reputational harm if context is misunderstood.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 87% confidence

Finding

Using nohup to launch the monitor creates session persistence beyond the immediate interaction. In this skill's context, persistence is more dangerous because the background process monitors private messaging state and can feed later autonomous actions without the user's ongoing awareness.

Content

Scanner excerpt · SKILL.md (reported line 276)May include surrounding context.

macOS:

bash

nohup python3 scripts/wechat_monitor.py \
  --contact "联系人名称" \
  --interval 600 \
  --threshold 1000 \

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs creation of a recurring automation that continues reading chat state and sending messages after the initial user action. Persistent autonomous behavior in a private messaging app materially increases risk of unintended surveillance, runaway actions, and delayed replies being sent without contemporaneous user awareness.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The recurring automation continuously checks pending chat state, re-screenshots conversations, and generates responses from private context without requiring a fresh user action each time. That creates a durable privacy exposure and raises the risk of incorrect or overbroad responses based on sensitive conversation content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The usage text describes screenshot-based monitoring and analysis of WeChat conversations but does not clearly warn users that message content and other visible on-screen data may be captured and processed. This creates a privacy and consent risk because users may enable the skill without understanding that sensitive personal or business communications can be collected and analyzed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation explains the automation flow but does not present a prominent warning that the system will generate and send WeChat messages on the user's behalf. This can lead to unintended impersonation, accidental transmissions, or reputational harm if users do not fully appreciate that outbound communication is autonomous after setup.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The guide documents screenshot capture, UI inspection, window control, and simulated input for WeChat, but does not prominently warn that these capabilities can expose private conversations, capture unrelated on-screen data, or send unintended messages. In the context of an auto-reply/monitoring skill, these actions directly operate on a real user's desktop and messaging client, which increases the chance of privacy harm or accidental misuse if users follow the instructions without understanding the risks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring, CLI help text, and runtime log messages are presented only in Chinese, which imposes a specific language/locale on users. The policy allows locale constraints only when documented and justified or when users are offered a choice, neither of which is present here.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/wechat_monitor.py (reported line 79)May include surrounding context.

python

class PeekabooMacEngine(ScreenshotEngine):
    """macOS Peekaboo CLI 截图引擎"""
    def take_screenshot(self, path, app_name="微信"):
        r = subprocess.run(
            ["peekaboo", "image", "--mode", "window",
             "--app", app_name, "--retina", "--path", path],
            capture_output=True, text=True, timeout=15

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The code explicitly sets the execution path to npx as a fallback, which means the runtime may download and execute the peekaboo-win package without a pinned version or integrity control. In a desktop-monitoring skill with screen-capture privileges, this materially increases risk because any malicious package code would run with access to sensitive user context and screenshots.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 90% confidence

Finding

On Windows, the code can fall back to executing npx peekaboo-win ... when no local binary is found. That behavior may fetch and run an unpinned package from the package ecosystem at runtime, creating a supply-chain execution risk where a malicious or tampered package could execute arbitrary code on the host.

Content

Scanner excerpt · scripts/wechat_monitor.py (reported line 150)May include surrounding context.

python

"--output", path]

        try:
            r = subprocess.run(cmd, capture_output=True, text=True, timeout=15)
            if r.returncode != 0:
                print(f"  PeekabooWin stderr: {r.stderr.strip()}", flush=True)
            return r.returncode == 0

Static analysis

No suspicious patterns detected.