baoyu-wechat-summary
Warn
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONCOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DATA_EXFILTRATION]: The skill is designed to access highly sensitive private data located in path '
/Library/Containers/com.tencent.xinWeChat/' (WeChat message store) and '/.wx-cli/' (session keys and configuration). It explicitly requires the execution environment to use 'dangerouslyDisableSandbox: true' to bypass security controls and facilitate this access. While this is the core function of the skill, it represents a significant exposure of private user data to the AI agent.\n- [PROMPT_INJECTION]: The skill exhibits a high surface for Indirect Prompt Injection by design.\n - Ingestion points: Untrusted message data from WeChat group chats is fetched via the 'wx history' command and processed as the primary input for summarization.\n
- Boundary markers: The skill uses JSON parsing for the underlying message structure but relies on basic markdown '「」' delimiters in the output, which may not prevent malicious instructions within chat logs from being interpreted as commands by the agent during the multi-round processing workflow.\n
- Capability inventory: The agent is granted extensive capabilities, including file system writes (summaries, history, and profiles), command execution ('wx', 'jq', 'wc'), and unrestricted filesystem access via the disabled sandbox.\n
- Sanitization: The skill lacks explicit sanitization logic for message content before it is interpolated into prompts for summarization or used to answer bot-addressed requests.\n
- Injection Vector: The '@bot' feature (Step 3.9) allows any member of a monitored WeChat group to trigger specific agent logic by including an alias in their message, effectively allowing external actors to direct the agent's actions.\n- [COMMAND_EXECUTION]: The skill relies on several shell commands and the execution of an external 'wx' binary. Furthermore, the instructions provide the user with sensitive system commands, such as 'sudo chown' to modify directory ownership and 'codesign --force --deep' to modify the signature of the WeChat application binary, which can have significant security implications for the host system.\n- [EXTERNAL_DOWNLOADS]: The skill documentation identifies a required dependency on the '@jackwener/wx-cli' package from a non-standard source. Although it correctly advises the user to perform the installation manually, the tool is a core dependency and originates from an unverified third-party repository.
Audit Metadata