The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill utilizes sudo to perform memory scanning on macOS via the scripts/scan_dbkey_manager_macos.py script. It also performs ad-hoc code signing of the target WeCom application using the codesign utility in scripts/capture_key_macos.py to bypass security constraints such as task_for_pid restrictions and SIP-protected memory access.
[COMMAND_EXECUTION]: Multiple scripts use the subprocess module to execute system-level commands including pgrep, ps, codesign, vmmap, DevToolsSecurity, and csrutil to inspect system security status and modify application signatures.
[DYNAMIC_EXECUTION]: The scripts/capture_key_macos.py script uses the Frida framework to inject a custom JavaScript agent into the target application's memory to intercept cryptographic calls and capture database keys at runtime. Additionally, scripts/scan_dbkey_manager_macos.py uses ctypes to interact directly with Mach kernel APIs (mach_vm_region, mach_vm_read_overwrite) for raw memory scanning.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted chat messages and contact information from local SQLite databases, which could contain malicious instructions for the agent.
Ingestion points: scripts/vault_cli.py extracts raw message content from WeCom's local message.db.
Boundary markers: Absent. The extracted chat data is not wrapped in protective delimiters or accompanied by instructions to ignore embedded commands.
Capability inventory: The skill possesses powerful capabilities including arbitrary shell command execution, application re-signing, and memory injection across its script suite.
Sanitization: The _clean_text function in scripts/vault_cli.py only filters non-printable characters and does not protect against prompt injection patterns.

yichen-wecom-local-vault