WeChat Mail Bridge (Windows/OpenClaw)

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:32 PM UTC
• Version: 0.1.2

Overview

This appears to be a real WeChat-to-mail bridge, but its defaults expose sensitive chat and mail operations more broadly than users may expect.

Install only after changing the default shared secrets, binding the plugin to localhost or a protected private interface, using HTTPS or HMAC for any non-local traffic, disabling remote VLM or approving its exact endpoint, and deciding whether raw WeChat text should be retained. Treat the bundled dependency versions as needing an update before production use.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: bundle/windows-sidecar/src/oc_wx_bridge/adapters/uiautomation_adapter.py:296
• Finding: WeChat Screenshots Can Be Transmitted to an Arbitrary VLM Endpoint<![CDATA[ ## Vulnerability Details **File Location**: `bundle/windows-sidecar/src/oc_wx_bridge/adapters/uiautomation_adapter.py:296-355` **Vulnerability Type**: Privacy-sensitive data transmission to a configuration-controlled endpoint **Risk Level**: High ### Vulnerable Code ```python def _image_to_base64(self, image: object) -> str: max_side = 1200 image_copy = image.copy() width = getattr(image_copy, "width", 0) height = getattr(image_copy, "height", 0) if width > max_side or height > max_side: image_copy.thumbnail((max_side, max_side)) buffer = io.BytesIO() image_copy.save(buffer, format="PNG") return base64.b64encode(buffer.getvalue()).decode("ascii") def _extract_with_vlm(self, image: object) -> str | None: base_url = self.visual_config.vlm_base_url api_key = (self.visual_config.vlm_api_key or "").strip() if "api.openai.com" in base_url and not api_key: return None try: image_b64 = self._image_to_base64(image) payload = { "model": self.visual_config.vlm_model, "temperature": 0, "max_tokens": 100, "messages": [ { "role": "system", "content": ( "Extract only the latest user-authored WeChat message text from the screenshot. " "Prefer the newest actionable command such as /mail, /watch, 查邮箱, or a visible email query. " "Ignore timestamps, chat chrome, previous automation replies, and decorative labels. " "If unreadable, return an empty string." ), }, { "role": "user", "content": [ { "type": "text", "text": ( "Return only the exact raw latest message text, no JSON. " ...[truncated 2895 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Default visual processing to `off` or local OCR-only mode. 2. Require explicit operator consent before enabling remote VLM processing. 3. Enforce HTTPS for all non-loopback VLM endpoints. 4. Maintain an explicit allowlist of trusted VLM hosts and reject unexpected redirects. 5. Require credentials for remote endpoints rather than allowing unauthenticated arbitrary destinations. 6. Crop the image to the latest message bubble or otherwise redact previous messages, names, and unrelated UI data before transmission. 7. Display a clear startup warning identifying the exact destination receiving screenshots. 8. Add audit logging that records when an image is transmitted without logging the image or API key. 9. Support a fully local VLM option for deployments that handle sensitive communications. 10. Separate OCR fallback from remote VLM fallback so low OCR confidence does not silently trigger external disclosure. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: bundle/plugin/src/config/schema.ts:123
• Finding: Network-Wide Default Listener Uses a Predictable Development Secret<![CDATA[ ## Vulnerability Details **File Location**: `bundle/plugin/src/config/schema.ts:123-131` **Vulnerability Type**: Insecure network and authentication defaults **Risk Level**: High ### Vulnerable Code ```typescript return { server: { host: env.HOST ?? "0.0.0.0", port: Math.max(1, parseNumber(env.PORT, 8787)) }, bridge: { sharedSecret: env.BRIDGE_SHARED_SECRET ?? "dev-bridge-secret", authWindowSec: Math.max(0, parseNumber(env.AUTH_WINDOW_SEC, 300)), ``` ### Technical Analysis The plugin listens on all network interfaces when `HOST` is not supplied and silently falls back to the known value `dev-bridge-secret` when `BRIDGE_SHARED_SECRET` is absent. These defaults combine network exposure with predictable authentication. The reviewed routes use the bridge secret to protect sidecar and administrative operations. A fixed fallback therefore does not provide meaningful security against an attacker who can reach the service. The application does not fail closed when a production secret is missing. Bearer authentication also exposes the secret to interception if the service is used over unencrypted HTTP on an untrusted network. HMAC support exists, but the default configuration does not require it or TLS. ### Attack Path 1. An operator starts the plugin without setting `HOST` or `BRIDGE_SHARED_SECRET`. 2. The service listens on `0.0.0.0:8787`. 3. A network attacker discovers or otherwise reaches port 8787. 4. The attacker sends `Authorization: Bearer dev-bridge-secret`. 5. The server accepts the predictable fallback secret. 6. The attacker invokes authenticated sidecar or administrative endpoints, subject to each endpoint's request schema. Examples of protected capabilities found in the reviewed route registry include event submission, command claiming and acknowledgement, monitoring changes, binding management, maintenance operations, and operational record queries. ### Impact Assessment An authenticated attacker can impersonate ...[truncated 744 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Bind to `127.0.0.1` by default. 2. Require `BRIDGE_SHARED_SECRET` at startup and fail closed when it is absent. 3. Reject `dev-bridge-secret`, empty values, and other known development credentials unless an explicit development-mode flag is enabled. 4. Require a randomly generated secret with sufficient entropy, such as at least 32 random bytes. 5. Use separate credentials and authorization scopes for sidecar operations and administrative operations. 6. Require TLS whenever the listener is reachable beyond loopback; do not transmit bearer secrets over plaintext HTTP. 7. Prefer replay-resistant HMAC authentication with a strictly positive time window and nonce validation. 8. Add startup warnings when binding to a non-loopback address. 9. Document firewall restrictions and recommend exposing the service only through an authenticated reverse proxy or private network. 10. Add automated tests confirming that production startup fails with a missing or known default secret. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: bundle/windows-sidecar/src/oc_wx_bridge/diagnostics_server.py:14
• Finding: Unauthenticated Diagnostics Endpoint Exposes WeChat Group Metadata<![CDATA[ ## Vulnerability Details **File Location**: `bundle/windows-sidecar/src/oc_wx_bridge/diagnostics_server.py:14-49` **Vulnerability Type**: Missing authentication on a sensitive diagnostic endpoint **Risk Level**: Medium ### Vulnerable Code ```python class _DiagnosticsHandler(BaseHTTPRequestHandler): adapter: WeChatDesktopAdapter bridge_client: BridgeClient def do_GET(self) -> None: # noqa: N802 if self.path == "/health": self._handle_health() return if self.path == "/groups": self._handle_groups() return self.send_response(404) self.end_headers() def _handle_health(self) -> None: try: adapter_health = self.adapter.health().model_dump() bridge_health = self.bridge_client.health() payload = { "ok": True, "adapter": adapter_health, "bridge": bridge_health, } self._send_json(200, payload) except Exception as error: self._send_json(500, {"ok": False, "error": str(error)}) def _handle_groups(self) -> None: try: groups = self.adapter.list_groups() payload = { "ok": True, "count": len(groups), "groups": [{"chatId": g.chat_id, "chatName": g.chat_name} for g in groups], } self._send_json(200, payload) except Exception as error: self._send_json(500, {"ok": False, "error": str(error)}) ``` The listener is created from the configurable host and port: ```python server = ThreadingHTTPServer((config.host, config.port), _DiagnosticsHandler) ``` ### Technical Analysis Neither `/health` nor `/groups` verifies an authentication token or caller identity. The `/groups` endpoint invokes the desktop adapter and returns discovered chat identifiers and names. The default diagnostic host is `127.0.0.1`, which subst ...[truncated 1357 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require an authentication token for `/groups` and any detailed health response. 2. Use constant-time comparison when validating diagnostic credentials. 3. Keep a minimal unauthenticated `/health` endpoint that returns only a boolean liveness result. 4. Remove group names and identifiers from default diagnostic output. 5. Refuse non-loopback diagnostic bindings unless an explicit secure remote-diagnostics mode is enabled. 6. Require TLS or place remote diagnostics behind an authenticated reverse proxy. 7. Add rate limiting and access logging without recording sensitive group names. 8. Where supported, use operating-system access controls or a local named pipe instead of an unauthenticated TCP listener. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: bundle/plugin/src/config/schema.ts:167
• Finding: Raw WeChat Message Text Is Persisted by Default<![CDATA[ ## Vulnerability Details **File Location**: `bundle/plugin/src/config/schema.ts:167-171` **Vulnerability Type**: Excessive default retention of sensitive message data **Risk Level**: Medium ### Vulnerable Code ```typescript privacy: { redactEmailsInLogs: parseBoolean(env.PRIVACY_REDACT_EMAILS_IN_LOGS, true), storeRawWechatText: parseBoolean(env.PRIVACY_STORE_RAW_WECHAT_TEXT, true), storeRawMailBody: parseBoolean(env.PRIVACY_STORE_RAW_MAIL_BODY, false) } ``` ### Technical Analysis `storeRawWechatText` defaults to `true`, causing the application to retain complete incoming WeChat text unless the operator explicitly disables the behavior. Raw commands may contain email addresses, search terms, personal communications, internal business information, or other sensitive content. The declared bridge functionality generally requires parsing actionable commands and maintaining enough state to process them. Long-term retention of the complete original message is not necessarily required and violates data-minimization principles in privacy-sensitive deployments. Email-address log redaction does not mitigate database persistence because it affects logs rather than the raw stored text. ### Attack Path 1. The plugin starts without `PRIVACY_STORE_RAW_WECHAT_TEXT` being set to `false`. 2. A user sends a bridge command or other accepted WeChat message containing sensitive data. 3. The bridge processes the event and retains the original text in its SQLite-backed state. 4. An attacker or unauthorized local user gains read access to the database, a copied backup, or an exported state file. 5. The attacker recovers historical raw WeChat content. ### Impact Assessment The issue increases the confidentiality impact of filesystem, backup, or database compromise. Exposed data may include historical commands, email addresses, personal text, and operational context. This setting does not create a direct remote exploit or grant additional operating-system privil ...[truncated 165 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Change the default of `PRIVACY_STORE_RAW_WECHAT_TEXT` to `false`. 2. Persist only the parsed command type, normalized identifiers, timestamps, and fields strictly required for bridge operation. 3. Hash or tokenize identifiers when exact plaintext values are unnecessary. 4. Introduce short, configurable retention periods and automatic deletion for raw records. 5. Apply restrictive filesystem permissions to the SQLite database and its backup locations. 6. Encrypt sensitive state at rest where the deployment threat model warrants it. 7. Document exactly which message fields are retained and for how long. 8. Provide a migration or cleanup command to remove raw historical content from existing databases. 9. Add tests confirming that raw message content is absent when privacy-preserving defaults are used. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (68)

Known Vulnerable Dependency: vitest==3.2.4 — 2 advisory(ies): CVE-2026-47429 (When Vitest UI server is listening, arbitrary file can be read and executed); CVE-2026-84373 (Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock)

Critical

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Known Vulnerable Dependency: vitest==3.2.4 — 2 advisory(ies): CVE-2026-47429 (When Vitest UI server is listening, arbitrary file can be read and executed); CVE-2026-84373 (Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock)

Critical

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: Vitest is a development dependency, but the cited advisories include arbitrary file read and possible execution when the Vitest UI server is exposed. This is less dangerous than a runtime production dependency, yet it can still meaningfully impact developer workstations or CI agents if test tooling is run in a reachable environment.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared description is about operational support for a Windows WeChat automation and mail bridge bundle: installation, configuration, execution, troubleshooting, File Transfer Assistant workflows, and sidecar/plugin setup. The supplied code chunk instead is a narrow TypeScript mock adapter for mail functionality. It simulates adapter health, returns fabricated mail lookup/watch results, and converts generic payloads into a normalized webhook event. This is a materially different primary purpose from the declared operational/admin workflow description, so the description does not accurately represent this code chunk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: This code chunk is purely a type/interface definition for mail adapter behavior. It specifies contracts for mail-related querying and webhook normalization, but it does not implement or indicate the broader declared functionality around Windows WeChat automation, bundle installation, configuration, sidecar setup, or operational troubleshooting. The mail-related aspect is only a small supporting component and does not accurately represent the declared primary purpose.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The supplied code chunk does not perform installation, configuration, running, troubleshooting, sidecar setup, or WeChat desktop automation tasks. Instead, it provides a generic utility for finding and validating email addresses in text. While email handling could hypothetically support a mail bridge system, this specific behavior is not represented in the declared description and is materially different from the stated operational/admin purpose of the skill bundle.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The code is a focused parser for mail-related trigger messages. It examines text content, matches configured prefixes, distinguishes watch-style commands from normal lookup commands, extracts email addresses, and returns structured decisions such as ignore, clarify, findLatest, or waitForNew with timeout handling. The declared description instead emphasizes installing, configuring, running, and troubleshooting a Windows WeChat automation and mail bridge bundle, plus sidecar/plugin operational setup. That broad operational description does not accurately represent this code chunk’s concrete behavior as a trigger parser for email commands. While mail bridge functionality is loosely related, the actual code exposes a specific command/trigger interpretation capability that is not declared, so this is a description-behavior mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The declared description emphasizes operational tasks around installing, configuring, running, and troubleshooting a Windows WeChat desktop automation and mail bridge bundle. In contrast, this code chunk is specifically a security/authentication module for validating incoming requests using bearer tokens or HMAC signatures, with timestamp and nonce-based anti-replay protections. While such code could support a bridge component, its concrete behavior is a backend auth mechanism rather than the described automation/setup/troubleshooting functionality. This is a materially different capability and should be flagged as a description-behavior mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description promises substantial operational functionality around Windows WeChat automation and mail bridge setup. However, the supplied code chunk contains only package metadata: an __all__ declaration and a __version__ constant. This is not merely incomplete implementation detail for the stated features within the snippet; it shows no behavior corresponding to the declared purpose. Therefore, the code chunk does not accurately represent the described functionality.

Known Vulnerable Dependency: fast-uri==3.1.0 — 7 advisory(ies): CVE-2026-13676 (fast-uri vulnerable to host confusion via failed IDN canonicalization); CVE-2026-18446 (fast-uri vulnerable to host confusion via backslash authority introducer); CVE-2026-75975 (fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizat) +4 more

High

• Category: Supply Chain
• Confidence: 88% confidence
• Finding: fast-uri is a runtime dependency used through Fastify's request parsing and URL handling stack, so host confusion or malformed URI parsing flaws can affect a live HTTP service if attacker-controlled requests are accepted. In a mail bridge/plugin context, incorrect host or URI interpretation can enable SSRF, origin confusion, or security control bypasses around inbound API handling.

Known Vulnerable Dependency: fastify==5.8.2 — 3 advisory(ies): CVE-2025-32442 (Fastify has a Body Schema Validation Bypass via Leading Space in Content-Type He); CVE-2026-3635 (fastify: request.protocol and request.host Spoofable via X-Forwarded-Proto/Host ); CVE-2026-18504 (fastify vulnerable to schema validation bypass via root primitive coercion misma)

High

• Category: Supply Chain
• Confidence: 94% confidence
• Finding: fastify is a direct runtime dependency and likely underpins the plugin's local or network API surface. The cited issues include schema validation bypass and spoofable host/protocol handling, which can undermine authentication, request trust boundaries, and input validation in a bridge component that may process mail or message automation commands.

Known Vulnerable Dependency: find-my-way==9.5.0 — 1 advisory(ies): CVE-2026-47219 (find-my-way: DDoS with HTTP2)

High

• Category: Supply Chain
• Confidence: 86% confidence
• Finding: find-my-way is Fastify's router and is a runtime dependency, so a known DDoS condition in HTTP/2 routing can affect availability if the bridge exposes an HTTP/2 listener. While package-lock alone does not prove HTTP/2 is enabled, this is still a credible runtime risk in a server-oriented plugin.

Known Vulnerable Dependency: nanoid==3.3.11 — 3 advisory(ies): CVE-2026-67214 (nanoid: non-secure generators can loop indefinitely with negative size); CVE-2026-67213 (nanoid: custom generators can loop indefinitely when size is zero); CVE-2026-73086 (nanoid: Integer Overflow or Wraparound)

High

• Category: Supply Chain
• Confidence: 80% confidence
• Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Known Vulnerable Dependency: picomatch==4.0.3 — 2 advisory(ies): CVE-2026-33672 (Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Mat); CVE-2026-33671 (Picomatch has a ReDoS vulnerability via extglob quantifiers)

High

• Category: Supply Chain
• Confidence: 80% confidence
• Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Known Vulnerable Dependency: postcss==8.5.8 — 4 advisory(ies): CVE-2026-45623 (PostCSS: Arbitrary file read and information disclosure via attacker-controlled ); CVE-2026-69153 (PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappi); CVE-2026-41305 (PostCSS has XSS via Unescaped </style> in its CSS Stringify Output) +1 more

High

• Category: Supply Chain
• Confidence: 80% confidence
• Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Known Vulnerable Dependency: vite==7.3.1 — 5 advisory(ies): CVE-2026-39365 (Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling); CVE-2026-53571 (vite: `server.fs.deny` bypass on Windows alternate paths); CVE-2026-39363 (Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket) +2 more

High

• Category: Supply Chain
• Confidence: 80% confidence
• Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Known Vulnerable Dependency: fastify==5.8.2 — 3 advisory(ies): CVE-2025-32442 (Fastify has a Body Schema Validation Bypass via Leading Space in Content-Type He); CVE-2026-3635 (fastify: request.protocol and request.host Spoofable via X-Forwarded-Proto/Host ); CVE-2026-18504 (fastify vulnerable to schema validation bypass via root primitive coercion misma)

High

• Category: Supply Chain
• Confidence: 91% confidence
• Finding: The project allows a Fastify version family that static analysis associates with multiple security advisories, including request metadata spoofing and schema validation bypasses. In a mail bridge/automation plugin that likely exposes HTTP endpoints and processes external input, these flaws could let attackers bypass validation, misroute trust decisions, or manipulate request context.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The visual fallback feature can escalate from local OCR to a remote VLM endpoint, which may send sampled chat-area content to an external AI service. Because the README omits a clear warning about external transmission of potentially sensitive WeChat messages, operators could enable the feature without understanding the privacy and compliance implications.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The manifest describes bridging WeChat content to a mail system and the schema defaults `privacy.storeRawWechatText` to true, yet there is no explicit user-facing warning or consent notice in the manifest. This creates a meaningful privacy and compliance risk because users may not realize message contents are being stored or relayed across systems.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: This manifest defines activation prefixes such as "监控" alongside more specific commands, but the term is broad and could overlap with ordinary conversation. The file does not provide negative examples or contextual limits here to clarify when the skill should activate versus ignore a message.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

"skills": [
    {
      "id": "wechat-mail-bridge",
      "path": "skills/wechat-mail-bridge/SKILL.md"
    }
  ]
}

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

External Transmission

Medium

• Category: Data Exfiltration

Content

EVENT_ID="evt_smoke_$(date +%s)"
MSG_ID="msg_smoke_$(date +%s)"

curl -sS -X POST "${BASE_URL}/api/v1/sidecar/events" \
  -H "Authorization: Bearer ${SECRET}" \
  -H "x-bridge-ts: ${TS}" \
  -H "content-type: application/json" \

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

local nonce
  nonce="nonce_$(date +%s%N)"

  curl -sS -X POST "${BASE_URL}${path}" \
    -H "Authorization: Bearer ${SECRET}" \
    -H "x-bridge-ts: ${ts}" \
    -H "x-bridge-nonce: ${nonce}" \

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

local nonce
  nonce="nonce_$(date +%s%N)"

  curl -sS -X POST "${BASE_URL}${path}" \
    -H "Authorization: Bearer ${SECRET}" \
    -H "x-bridge-ts: ${ts}" \
    -H "x-bridge-nonce: ${nonce}" \

• Confidence: 89% confidence
• Finding: This curl call performs external transmission of bearer authentication headers and JSON payloads containing chat IDs, names, sender metadata, and message text. In this skill context, external transmission is expected for a bridge smoke test, but it still becomes a real security issue because the default transport is unsecured HTTP and the script encourages use of a reusable secret in requests.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script transmits a bearer secret and chat/message metadata using a default BASE_URL of plain HTTP, which provides no transport confidentiality or integrity if the endpoint is changed away from localhost or traffic is intercepted on the host. Because this is an operations smoke-test script for a mail/WeChat bridge, the transmitted data includes authentication material and potentially sensitive message content, making accidental insecure deployment more dangerous.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.install_untrusted_source

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: bundle/windows-sidecar/src/oc_wx_bridge/webhook_proxy.py:29

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: config/windows-sidecar.example.toml:7