T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:48- Finding
Screen-Capture Restriction Bypass and Overbroad Desktop Capture
- Content
View full analysis
- Remediation
View remediation
Security audit
Wechat Sender
Security checks for vulnerabilities and agentic risk
Overview
This skill is meant to automate WeChat sending, but it also instructs broad screen capture and explicitly describes bypassing capture restrictions, which users should review carefully.
Install only if you are comfortable with an agent controlling WeChat, taking screenshots of chat UI, and sending messages on your behalf. Before use, require a manual confirmation step for the exact recipient and message, avoid whole-screen capture, and do not use workflows that bypass an app's screen-capture protections.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill explicitly advises operators to '绕过' anti-screen-capture protections by focusing and resizing the WeChat window. That is a security-boundary bypass unrelated to the core task of sending a message and normalizes defeating application privacy safeguards, which could expose protected chat content or other sensitive UI data.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger phrases include generic language like '发微信' and '给xxx发消息', which can appear in ordinary conversation and may invoke the skill unexpectedly. Because the skill performs outbound messaging and screen-driven automation, accidental activation could lead to unintended actions or privacy-invasive capture.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill describes automatic message sending and screenshot-based visual analysis but does not prominently warn users that it may capture screen contents and send messages on their behalf. In this context, missing consent and action-impact disclosure is dangerous because both messaging and screen capture can affect third parties and expose sensitive data.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill directs use of raw shell commands such as curl and screencapture to obtain images, expanding the capability from narrow message sending to general system interaction. Even if intended for convenience, this broadens the attack surface and makes it easier to capture arbitrary data or repurpose the skill beyond its stated function.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill recommends whole-screen or large-region capture (for example 0,0,1200,900 and '默认捕获整个屏幕'), which exceeds the minimum data needed to select a contact and send a message. This can unintentionally collect unrelated applications, notifications, credentials, or private conversations visible on screen.
- Content
Static analysis
No suspicious patterns detected.