The Agent Skills Directory

[COMMAND_EXECUTION]: The script extract_keys.py uses subprocess.run to execute system commands including codesign (to re-sign the WeChat binary), pgrep (to find running processes), and pip (to install packages). It also generates a temporary Python script at runtime and executes it as a child process.
[EXTERNAL_DOWNLOADS]: The extract_keys.py script contains logic to automatically download and install third-party libraries (frida, frida-tools, pycryptodome) from the Python Package Index (PyPI) if they are missing from the environment.
[DYNAMIC_EXECUTION]: The skill performs dynamic code generation and execution. Specifically, extract_keys.py assembles a Frida instrumentation script and a Python host wrapper from templates, writes them to a temporary file, and executes them to hook into the WeChat process memory.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from WeChat chat history and social feeds.
Ingestion points: Data is read from local SQLite databases via vault_cli.py, export_chat.py, and search_sns.py.
Boundary markers: The SKILL.md instructions recommend summarizing content and writing full exports to files to limit the amount of raw, untrusted text in the LLM context.
Capability inventory: The skill can execute subprocesses, perform ad-hoc code signing, and read/write to the filesystem.
Sanitization: Content is partially normalized and decoded (e.g., Zstd decompression) before processing, but lacks robust sanitization of potentially malicious instructions embedded in chat messages.

wechat-local-vault