yichen-wecom-local-vault

SUSPICIOUS: the skill’s capabilities broadly match its stated purpose of local WeCom data recovery, but that purpose itself requires invasive key-capture, process memory access, sudo-assisted scanning, and app re-signing. No clear exfiltration or malicious endpoint appears, so this is not confirmed malware; however, the operational footprint is high-risk and should only be used with strong user consent on owner-authorized data.