wechat

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The prompt includes CLI flags and examples that encourage embedding secrets (e.g., --bearer / --webhook-secret and "Authorization: Bearer ") which can require the model to emit secret values verbatim in commands/requests, creating an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly ingests untrusted user-generated content — e.g., it consumes WeChat inbound messages via the bridge SSE (/messages/stream) and HTTP endpoints and also polls/acts on third‑party SaaS outbox rows via the documented "wechat orchestrate" flow (docs/v1.12-orchestrate-protocol.md and SKILL.md), and that content is read by the agent and can directly drive sends/handlers, so it can carry indirect prompt-injection instructions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill instructs runtime installation using a remote install script that is fetched and executed (curl -fsSL https://raw.githubusercontent.com/leeguooooo/wechat-skill/main/install.sh | bash), which downloads and runs remote code and is required to provide the wechat binary the skill depends on, so it meets the criteria for a high-confidence runtime-executed external dependency.

MEDIUM W021: Hidden or invisible Unicode characters detected (potential obfuscation or prompt injection).

• Hidden Unicode characters detected (1 type(s) found)