wechat-devtools-mcp

SUSPICIOUS: The skill’s capabilities are broadly consistent with its stated purpose of local WeChat DevTools automation, and data flows mainly target the official local WeChat CLI rather than an unrelated remote gateway. However, the install footprint adds medium risk through unpinned PyPI installs, mutable GitHub-based skill installation, and explicit transitive trust via skills add from a personal repo. This looks more like a legitimate developer workflow skill with supply-chain and trust-chain concerns than confirmed malware.