Wecom

• Outcome: Pass
• Latest audit: May 27, 2026, 9:31 PM
• Version:
  1.0.3

Overview

This skill is a straightforward WeCom messaging connector that sends user-provided messages to the configured WeCom webhook.

Install this only if you want an agent to post into the configured WeCom chat. Keep the webhook URL secret, confirm the destination group, avoid sending secrets or confidential data unless intended, and prefer reviewed local files or verified npm provenance for installation.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The README explicitly describes sending message content to an external WeCom webhook but does not warn users that provided content leaves the local environment and is transmitted to a third-party service. In an agent skill context, this can lead to accidental disclosure of prompts, secrets, personal data, or internal business information if users or upstream agents pass sensitive content into the tool.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly sends user-provided text and markdown to an external WeCom webhook, but the documentation does not clearly warn users that any supplied content will leave the local environment and be transmitted to a third-party messaging service. This can lead to unintended disclosure of sensitive prompts, secrets, internal reports, or personal data if users treat the tool as a local formatting utility rather than an outbound network integration.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The tool accepts arbitrary caller-provided content and transmits it to an external WeCom webhook, but the interface does not provide any explicit disclosure, consent gate, or policy check before data leaves the local environment. In an MCP context, this creates a real exfiltration channel because an agent or prompt-injected workflow could send sensitive user or system data to a remote service without the user's informed awareness.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This markdown variant has the same security property as the text sender: untrusted content is posted to a remote webhook with no clear disclosure that data leaves the system. Because markdown may contain richer structured content, an LLM-driven agent could package substantial sensitive context and exfiltrate it through this tool.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The markdown_v2 tool sends arbitrary content to an external service without explicit disclosure or any protective control around outbound data flow. Its richer formatting support increases the practicality of packaging tables, code blocks, or summaries of sensitive information for exfiltration if the tool is misused by an agent or via prompt injection.

VirusTotal

67/67 vendors flagged this skill as clean.