kelly-wechat-crm
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill interacts with the operator's local WeChat installation by executing the
wechat-cli-rsbinary. - It invokes commands such as
contacts,sessions,history, andstatsto retrieve relationship data. - A safety wrapper (
scripts/wechat-safe.mjs) is used to ensure only read-only commands are allowed and to redact credentials or tokens from the output before processing. - [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it ingests untrusted data from local WeChat messages and contact remarks.
- Ingestion points: Raw data is read via
wechat-cli-rsthrough thewechat-safe.mjsscript. - Boundary markers: The instructions do not specify explicit delimiters (like XML tags) for the interpolated WeChat content within the prompt.
- Capability inventory: The skill can write summaries, goals, and suggested actions to the Busabase backend using the
busabase-sdk. - Sanitization: A dedicated redaction library (
scripts/lib/sensitive-content.mjs) is implemented to filter out secrets, tokens, and credentials from the data stream. - [EXTERNAL_DOWNLOADS]: The skill references external documentation at
https://wechat-cli.com/SKILL.mdto define authoritative JSON shapes and command limits for the local connector.
Audit Metadata