The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the Bash tool to execute its internal Python helper script (personal_wechat.py). This is a standard mechanism for skill functionality and does not involve arbitrary command injection.
[DATA_EXFILTRATION]: The skill accesses sensitive personal data, including WeChat contacts, conversation lists, and message history. While this is the intended function and the data remains within the user's self-hosted environment, it constitutes access to highly sensitive communication records.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted text from incoming WeChat messages. 1. Ingestion points: Message content is retrieved via the /api/messages and /api/messages/history endpoints in personal_wechat.py. 2. Boundary markers: There are no explicit instructions or delimiters provided to the agent to treat incoming message content as untrusted data. 3. Capability inventory: The skill possesses the capability to send messages to other users, which could be abused if an incoming message influences the agent's actions. 4. Sanitization: The helper script implements basic truncation of message text to 800 characters but does not perform content sanitization for injection patterns.
[CREDENTIALS_UNSAFE]: The skill manages credentials using environment variables (PERSONALWECHAT_API_TOKEN) and provides explicit instructions for the agent never to log or print the token, adhering to security best practices for secret handling.

personal-wechat