baoyu-post-to-wechat

BENIGN for purpose alignment, but HIGH operational risk because it lets an AI agent publish publicly and may use multiple sensitive channels (WeChat API credentials, browser session, SSH tunnel, optional Telegram). Data flow is mostly coherent with the stated purpose and official WeChat endpoints, with moderate added risk from optional remote and QR-forwarding features.

The code’s most suspicious/sensitive behavior is explicitly exfiltrating the WeChat login QR code to an external third-party (Telegram) when TELEGRAM_BOT_TOKEN and TELEGRAM_CHAT_ID are set. This can enable account login by any party with access to the Telegram bot/chat and is a clear privacy/authentication-data leakage vector. Additionally, the module uses CDP Runtime.evaluate (dynamic execution) and credentialed fetch within the authenticated browser context, which further increases the impact if the QR capture is not strictly intended by the operator. Other parts primarily perform expected browser automation for article posting.

This dependency implements cross-platform OS-level keystroke injection to perform a real paste (Cmd+V/Ctrl+V) into the active UI context, explicitly aiming to bypass detection of synthetic events. The snippet does not show direct data theft or network exfiltration, but it is inherently abuse-prone (clipboard/automation enabling) and contains a concrete script-injection risk on macOS by interpolating the unvalidated --app value into an AppleScript program executed by osascript. Overall, treat as a security-sensitive automation component and restrict/control how CLI inputs and execution context are provided.