Skills
Navigate
skills/reason-machines/devtools-skills/wx-cli-wechat-local-data/Gen Agent Trust Hub

wx-cli-wechat-local-data

Fail

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: HIGHREMOTE_CODE_EXECUTIONPRIVILEGE_ESCALATIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill promotes installation methods that download and immediately execute scripts from a remote repository without prior verification.
  • Evidence: curl -fsSL https://raw.githubusercontent.com/jackwener/wx-cli/main/install.sh | bash in SKILL.md.
  • Evidence: irm https://raw.githubusercontent.com/jackwener/wx-cli/main/install.ps1 | iex in SKILL.md.
  • [PRIVILEGE_ESCALATION]: The initialization process requires root/administrative access and modifies system-wide security configurations to facilitate memory scanning.
  • Evidence: Use of sudo wx init for Linux and macOS setup.
  • Evidence: Instructions to use tccutil reset to clear privacy protections for ScreenCapture, Camera, Microphone, and AddressBook.
  • Evidence: Use of codesign to force ad-hoc signing of the WeChat application, effectively bypassing signature verification to allow memory tampering.
  • [EXTERNAL_DOWNLOADS]: The skill downloads binaries and scripts from unverified third-party sources on GitHub and the npm registry.
  • Evidence: npm install -g @jackwener/wx-cli downloads from the npm registry.
  • Evidence: Shell and PowerShell scripts are hosted on raw.githubusercontent.com/jackwener/wx-cli/.
  • [COMMAND_EXECUTION]: The skill provides extensive capabilities to interact with the local operating system, including killing processes and managing background daemons.
  • Evidence: killall WeChat && open /Applications/WeChat.app used during setup.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests large volumes of untrusted, external message data which is processed and returned to the agent, creating a surface for prompt injection.
  • Ingestion points: wx history, wx search, wx sns-feed, wx biz-articles (SKILL.md).
  • Boundary markers: The skill documentation does not mention the use of delimiters or 'ignore' instructions when processing message content.
  • Capability inventory: The skill can execute file system reads, process memory scans, and shell commands via the wx binary.
  • Sanitization: No sanitization or filtering of the retrieved WeChat content is described; data is returned as raw strings in JSON format.
Recommendations
  • HIGH: Downloads and executes remote code from: https://raw.githubusercontent.com/jackwener/wx-cli/main/install.sh - DO NOT USE without thorough review
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Sep 15, 2026, 12:11 PM
Security Audit — agent-trust-hub — wx-cli-wechat-local-data