wx-cli-wechat-local-data
Warn
Audited by Socket on Sep 15, 2026
1 alert found:
SecuritySecuritySKILL.md
MEDIUMSecurityMEDIUM
SKILL.md
SUSPICIOUS: the data-access capabilities are broadly aligned with a local WeChat forensics/export CLI, but the trust story is inconsistent. The skill is published as ara.so while installation and transitive trust point to jackwener, and it promotes raw GitHub pipe-to-shell installers plus a third-party skill install. No obvious credential exfiltration or off-machine data routing is described, but the install and delegation paths are not proportionate to a high-trust agent skill without clearer same-org provenance.
Confidence: 89%Severity: 72%
Audit Metadata