WeChat Send

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:08 AM UTC
• Version: 1.0.0

Overview

This skill’s WeChat-sending purpose is disclosed, but it has unsafe AppleScript construction and sends messages or files immediately without a confirmation step.

Review this before installing. It should only be used with trusted, user-supplied recipients, messages, and file paths, and it would be safer after changing the scripts to pass values to AppleScript as arguments plus adding a confirm-before-send or draft-only mode.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/wechat_send.sh:35

Finding

AppleScript Injection Through Contact Name in Text-Sending Script

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/wechat_send.sh:76

Finding

AppleScript Injection Through Message Content

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/wechat_send_image.sh:42

Finding

AppleScript Injection Through Contact Name in File-Sending Script

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/wechat_send_image.sh:82

Finding

AppleScript Injection Through Attachment File Path

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The code is broadly aligned with the declared purpose of controlling the macOS WeChat GUI to send messages on the user's behalf. It uses AppleScript/System Events and JXA mouse events exactly as described, and it does not read incoming messages or act as a chat channel. However, the description explicitly claims the skill can send text messages and images/files, while this code chunk only supports sending plain text. There is no logic for selecting, attaching, or sending images/files. That makes the description overstated relative to the actual implemented capability in the supplied code.

Content

No source excerpt is available for this finding.

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · SKILL.md (reported line 9)May include surrounding context.

md

# WeChat Send

Send messages to WeChat contacts by automating the macOS WeChat desktop app.

## Prerequisites

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest describes a skill that can send text messages and images/files in WeChat, but this script accepts only a contact name and message text, then pastes and sends that text. There is no code to select, attach, drag-drop, paste, or otherwise transmit images or files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script performs an irreversible send action via GUI automation with no confirmation step, preview, or safety interlock. In this skill context, untrusted or mistaken inputs can cause messages to be sent to the wrong contact or with unintended content, creating privacy, fraud, or social-engineering risk on the user's real WeChat account.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script performs an irreversible send action by simulating Enter immediately after attaching the file, with no user confirmation, preview validation, or safety interlock. In a UI automation skill that acts on behalf of the user, this increases the chance of accidental disclosure to the wrong contact or sending the wrong file, especially because contact selection and click targeting are also automated and potentially error-prone.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script's comments, usage output, progress messages, and success message are written in Chinese, which imposes a specific language on users. Under the stated policy, this is a natural-language locale constraint without opt-in or justification that the skill is only intended for Chinese-speaking users.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.