Wechat Work

Security checks across malware telemetry and agentic risk

Overview

This instruction-only skill is for summarizing public WeChat Work pages and does not request credentials, private access, scripts, or persistence.

Install only for summarizing public WeChat Work links. Avoid using it with private enterprise chats, admin consoles, authenticated pages, or confidential company material.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The skill description is overly broad and can cause the agent to invoke this skill for many generic enterprise-WeChat-related requests, not just narrowly scoped public-page summarization. Overbroad triggering increases the chance of unintended activation on sensitive or internal-content workflows, which can expand data exposure or cause the agent to take actions outside the skill's intended boundary.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal