Security audit

微信聊天记录知识卡片提取工具

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says at a high level, but it handles private chat exports, builds reusable profiles, and sends derived records to Feishu without enough consent, privacy, or access-control guidance.

Install only if you are authorized to process the chats involved. Review and redact exports before use, avoid sending sensitive conversations or customer details to broadly shared Feishu spaces, and set clear access and retention rules for any generated knowledge cards or tables.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The declared description promises a broader transformation pipeline: converting WeFlow chat exports into personal knowledge base content, knowledge cards, customer personas, and AI training data. The supplied code performs only lightweight parsing and summarization. It reads JSON, counts messages/senders, counts predefined business keywords, and writes a Markdown report with placeholders for manual completion. Although this partially aligns with 'analyzing WeChat chat records' and superficially with 'knowledge card extraction,' it does not implement the more substantial declared capabilities such as structured knowledge extraction, customer profiling, personal knowledge base construction, or training data generation. There are no undeclared dangerous behaviors, but the description materially overstates what the code actually does.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 83% confidence
Finding: The skill documentation instructs local file access (cat /path/to/weflow_export/*.json) and mentions writing data to Feishu, but it does not declare any explicit tool scope or permission boundaries. Missing scope declarations increase the chance that an agent may use broader file-read/write capabilities than intended when handling sensitive chat exports.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill processes private WeChat conversations and stores derived outputs in Feishu, yet it gives no privacy notice, consent guidance, or warning about transmitting personal data to an external service. This creates a realistic risk of unauthorized processing or disclosure of personal and business communications.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill advocates broad extraction of personal knowledge, customer profiles, and AI training data from chat logs, then storing the results externally, without any minimization, purpose limitation, or consent controls. That combination materially increases the likelihood of privacy harm, profiling misuse, and secondary use of private communications beyond the original context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instructions tell users to read local WeFlow-exported JSON files via shell commands without acknowledging that these files may contain sensitive personal, interpersonal, or commercial content. In practice this can normalize unsafe handling of highly sensitive exports and lead to unreviewed disclosure during analysis or storage.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The extraction instructions explicitly seek to compile names, needs, preferences, decisions, pricing, terms, and relationship history from chats into reusable records. Centralizing these sensitive interpersonal and business details creates a durable intelligence dataset that could expose confidential negotiations, customer profiling data, and private communications if misused or leaked.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs storing chat-derived profiles, communication style, and interaction history in Feishu documents and tables, but it includes no access-control, sharing, or retention safeguards. Persisting structured summaries in collaborative tools can amplify disclosure risk because derived records are easier to search, share, and repurpose than raw chats.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill directs use of exec/shell commands to read exported JSON files, which introduces an unnecessarily powerful primitive for a data-processing workflow. In an agent context, normalizing shell usage for file ingestion raises the risk of command injection, overbroad filesystem access, and accidental execution of unrelated commands against sensitive local data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This code processes WeChat chat records, which commonly contain personal or business-sensitive information, and later generates an output file from that data. While the script prints a success message after writing, it does not disclose to the user in its documentation or inline messaging that it will parse private chat content and produce a new file containing extracted information.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The module title and description are entirely in Chinese and do not provide an alternative language option or indicate that the tool is intended only for a Chinese-language audience. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.