wechat

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill ingests user-generated, untrusted WeChat messages via the local daemon/HTTP bridge/SSE (see SKILL.md sections on the SSE payload, "wechat listen --format json --on-message", and the wechat-bridge /messages/stream endpoints) and explicitly expects agents to read/interpret those messages and trigger actions (auto-replies, sends, webhook/orchestrate calls), so third-party message content can materially influence tool use and enable indirect prompt injection.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The SKILL.md explicitly instructs running a remote install script via curl -fsSL https://raw.githubusercontent.com/leeguooooo/wechat-skill/main/install.sh | bash, which fetches and executes remote code at runtime and is presented as the required install path for the CLI.