weread-notes-export
Fail
Audited by Gen Agent Trust Hub on Jul 28, 2026
Risk Level: CRITICAL
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill makes network requests to
https://i.weread.qq.com/api/agent/gateway. This domain belongs to Tencent (the parent company of WeChat Reading), a well-known and trusted service provider. These requests are used solely to fetch the user's own reading data via the provided API key. - [CREDENTIALS_UNSAFE]: The skill requires a
WEREAD_API_KEY. It correctly instructs the user to provide this via an environment variable (WEREAD_API_KEY) rather than hardcoding it, which is the standard safe practice for managing secrets. - [COMMAND_EXECUTION]: The skill does not execute any shell commands or external processes. It uses only Python's built-in modules for HTTP requests and file management.
- [DATA_EXFILTRATION]: There is no evidence of data being sent to third-party or unauthorized servers. Data fetched from the WeChat Reading API is written only to a local directory (defaulting to
~/.weread-notes/). - [PROMPT_INJECTION]: No malicious prompt instructions or attempts to override agent behavior were detected in the skill's documentation or scripts.
- [NO_CODE]: The skill consists of pure Python 3 code with zero external dependencies, reducing the risk of supply-chain attacks.
Recommendations
- CRITICAL: 1 file(s) identified as malware by FileRep - DO NOT USE
Audit Metadata