baoyu-wechat-summary

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). The GitHub repo https://github.com/jackwener/wx-cli is a third‑party personal project that supplies a privileged CLI binary the skill requires to run outside the sandbox and access local WeChat data, which — combined with an unverified maintainer — is a high-risk download source; the other links are documentation or the generic GitHub root and are not suspicious.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.95). Outsider-authored free text from the WeChat group (via wx history ... --json / wx sessions ... --json) is ingested as readable message content and then used to build the LLM digest context (including topic skeletons and @bot request bodies), which is classic indirect prompt-injection risk.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The skill explicitly requires disabling the agent sandbox (dangerouslyDisableSandbox: true) and instructs/encourages privileged operations (sudo chown, sudo wx init, codesign, etc.) that modify system ownership/config and thus push bypassing security and changing machine state.