yichen-wecom-local-vault

SUSPICIOUS rather than malicious: the skill is internally consistent with a local WeCom forensic/decryption workflow, and its data flow appears local-only with no clear exfiltration path. Risk is still medium because it captures encryption keys from process memory, may use Frida or sudo-assisted scanning, and produces plaintext chat snapshots, but the install trust is relatively normal and the scope is mostly proportional to the stated purpose.

The visible code appears to be a purpose-built local WeCom database-key capture and validation tool rather than conventional malware. It performs sensitive process instrumentation, application re-signing, and local key storage, so it should only be run with authorization and in an isolated environment. The missing FRIDA_AGENT assignment and unreviewed wecom_common module prevent a complete assessment; those components could materially change the risk. No network exfiltration, reverse shell, persistence, destructive behavior, or obvious obfuscation is visible in this fragment.

This is a local credential/key-recovery utility rather than clear malware. Its stated and implemented behavior is consistent with reverse-engineering or recovery of encrypted WeCom databases, but it has inherently high security impact because it reads another process's memory, obtains encryption-key material, requests root privileges, and persists the key. No evidence of exfiltration, persistence, sabotage, command injection, or obfuscated malicious payloads is present in the supplied fragment. Use should be limited to authorized systems and trusted copies of the script and its imported modules.