huo15-multi-wechat

• Outcome: Review
• Latest audit: Jul 30, 2026 · 9:31 AM UTC
• Version: 1.1.0

Overview

This skill appears to do what it says, but it should be reviewed because it modifies and re-signs WeChat app copies in /Applications and can delete existing copies with administrator privileges.

Review before installing. Only use this if you are comfortable creating modified, ad-hoc-signed WeChat copies in /Applications, deleting any existing WeChat2.app/WeChat3.app-style copies, and entering an administrator password if prompted. Back up or manually inspect existing copies first, and expect Gatekeeper/update/support implications.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The skill explicitly instructs use of shell commands and a script that copies apps, edits Info.plist metadata, re-signs binaries, deletes prior app bundles with rm -rf, and refreshes Launch Services, yet it declares no permissions. This mismatch is dangerous because it hides significant code-execution and system-modification capability from the permission model and from users reviewing the skill, increasing the chance of unauthorized or unsafe filesystem and application changes.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README explicitly instructs users to modify an official macOS app, change its bundle metadata, and apply ad-hoc re-signing to bypass single-instance and Launch Services restrictions. Even though the stated goal is convenience rather than malware delivery, this normalizes weakening Apple’s trust model and encourages users to run altered binaries outside normal vendor update and signature guarantees, which can increase exposure to integrity, support, and execution-trust issues.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script deletes existing /Applications/WeChatN.app bundles with rm -rf and may escalate privileges via osascript without an upfront confirmation prompt or dry-run. Although the paths are hard-coded and not attacker-controlled, this is still a real destructive action against system application directories and can cause unintended data loss or user confusion if old copies are removed unexpectedly.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script silently creates and modifies application bundles under /Applications, edits Info.plist metadata, renames executables, and re-signs the app. These system-impacting changes alter a trusted application and macOS app registration state; without strong disclosure, users may not understand that they are installing modified unsigned/ad-hoc-signed app variants that can trigger Gatekeeper or trust issues.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

if [ -d "$APP_PATH" ]; then
        OWNER=$(stat -f '%Su' "$APP_PATH" 2>/dev/null || echo "unknown")
        if [ "$OWNER" = "root" ]; then
            NEED_SUDO="$NEED_SUDO $APP_PATH"
        else
            rm -rf "$APP_PATH"
        fi

• Confidence: 91% confidence
• Finding: SUDO

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.