T09 · Insecure Skill Coding Practices
Error
- Location
server.py:15- Finding
Unverified UI Focus Can Send Messages to an Unintended Application or Recipient
- Content
View full analysis
500 and w.width < 2000: print("WeChat window is open") return True time.sleep(0.5) return False ``` ```python def search_contact(contact_name): pyautogui.hotkey('ctrl', 'f') time.sleep(0.3) pyautogui.hotkey('ctrl', 'a') time.sleep(0.1) pyautogui.press('delete') time.sleep(0.1) pyperclip.copy(contact_name) pyautogui.hotkey('ctrl', 'v') time.sleep(0.5) pyautogui.press('enter') time.sleep(0.5) print(f"Opened contact: {contact_name}") return True, None ``` ```python open_wechat() time.sleep(0.5) success, err = search_contact(contact_name) if not success: return False, err time.sleep(0.5) pyperclip.copy(message) time.sleep(0.2) pyautogui.hotkey('ctrl', 'v') time.sleep(0.3) pyautogui.press('enter') ``` ### Technical Analysis The automation performs global keyboard input without establishing that WeChat is still the foreground application. Although `open_wechat()` can return `False`, its return value is ignored by the message-sending path. The code then proceeds to issue search, paste, and Enter keystrokes regardless of the active window. `search_contact()` also returns success unconditionally. It does not verify that the search interface opened, that an exact contact was selected, or that the resulting chat belongs to the requested recipient. Window matching is based only on title and bro ...[truncated 1734 chars]- Remediation
View remediation