weixin-file-send
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFEDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides a mechanism for the agent to transmit files based on user prompts, creating a surface for indirect prompt injection attacks where a user could manipulate the agent into sending sensitive data.
- Ingestion points: User requests for files or images as described in SKILL.md (e.g., "send me the file", "发给我").
- Boundary markers: Absent; the instructions do not include delimiters or warnings to ignore malicious instructions embedded in the request.
- Capability inventory: The agent can trigger file transmission using the [AIONUI_CHANNEL_SEND] protocol block defined in the skill.
- Sanitization: Absent; there are no instructions or logic provided to validate the requested file path against a list of safe or permitted directories.
- [DATA_EXFILTRATION]: The defined protocol ([AIONUI_CHANNEL_SEND]) allows the agent to send any local file that exists at a specified path. Because the skill lacks constraints to a safe workspace or restrictions on file types, it can be used to exfiltrate sensitive information such as environment variables (.env), credentials, or private keys if the agent is prompted to access those paths.
Audit Metadata