Security audit

Weixin Send Media

Security checks for vulnerabilities and agentic risk

Overview

This skill is a narrow Weixin delivery helper that sends user-requested local files to the current chat, with no bundled code, persistence, or hidden behavior found.

Install this only if you want agents to send local or generated files into the current Weixin chat. Before asking it to send anything sensitive, confirm the exact file and recipient because the skill is designed to transmit the file directly.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger language is broad enough to activate on common file-sharing requests without strong guardrails about destination, sensitivity, or confirmation. In a skill that transmits local files to an external chat, overbroad routing can cause unintended exfiltration of local documents or generated artifacts to the wrong channel or recipient.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill describes sending local files into an external Weixin chat but does not prominently warn that it will transmit data off the local system. That omission weakens user awareness and informed consent, increasing the chance that sensitive files are sent externally without the user realizing the action crosses a trust boundary.

Natural-Language Policy Violations

Low

Confidence: 83% confidence
Finding: The example hard-codes the caption `测试文件`, which implies a specific language choice. The file does not state that Chinese is required for this skill, nor does it offer a language choice or explain a locale-specific constraint.

Static analysis

No suspicious patterns detected.