wechat-cli-local-data
Fail
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: HIGHCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFEPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill requires executing 'sudo wechat-cli init' to scan WeChat's process memory for encryption keys. On macOS, it also performs a modification of the WeChat application package using 'codesign' to add the 'com.apple.security.get-task-allow' entitlement, which explicitly disables security protections to allow external processes to inspect its memory.
- [EXTERNAL_DOWNLOADS]: The installation instructions direct users to download and execute third-party packages from unverified sources, specifically '@canghe_ai/wechat-cli' via npm and 'wechat-cli' via pip, which are then run with elevated privileges.
- [CREDENTIALS_UNSAFE]: The tool harvests WeChat encryption keys from memory and stores them in a local file at '~/.wechat-cli/keys.json'. These keys provide permanent access to decrypt and read all local WeChat message databases.
- [PROMPT_INJECTION]: The skill exposes an indirect prompt injection surface by processing untrusted data from WeChat messages. Ingestion points include the 'history', 'search', and 'new-messages' commands which fetch raw message content into the agent's context. The documentation lacks mention of boundary markers or sanitization for this external content, which could allow a remote sender to influence the agent's behavior via malicious message content.
Recommendations
- AI detected serious security threats
Audit Metadata