personal-wechat
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from WeChat messages and Moments, creating a surface for indirect prompt injection.
- Ingestion points: Incoming messages are fetched via the
/api/messagesand/api/messages/pollendpoints, and Moments are read via/api/moments(implemented inscripts/personal_wechat.py). - Boundary markers: The skill instructions and the
gate()function in the CLI helper enforce a 'dry-run first' policy. Any write operation (sending messages, posting/deleting Moments, or group management) requires an explicit--confirmflag from the user or a platform-validated--unattended-confirmflag. - Capability inventory: The skill can send text and media messages, post or delete Moments, and perform group management actions (create, invite, remove, rename) as seen in
scripts/personal_wechat.py. - Sanitization: The script performs basic truncation of message text to 800 characters in the
compact_messagefunction to prevent excessively large context injection, but does not perform semantic filtering of instructions embedded in chat data.
Audit Metadata