weixin-agent-sdk
Warn
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs users to install the
weixin-agent-sdkpackage and clone a repository from an unverified GitHub user account (wong2/weixin-agent-sdk). These sources are not affiliated with the skill author or a trusted organization. - [REMOTE_CODE_EXECUTION]: The documentation provides instructions to use
npx weixin-acp, which involves downloading and executing external packages directly from the npm registry at runtime. - [COMMAND_EXECUTION]: The integration for ACP-compatible agents uses shell commands to launch agents as subprocesses (e.g.,
npx weixin-acp start -- kimi acp), which involves dynamic process creation based on user-provided strings. - [INDIRECT_PROMPT_INJECTION]: The skill serves as a gateway for external untrusted messages from WeChat users to be processed by an AI agent, creating a vulnerability surface for indirect injection attacks.
- Ingestion points: Untrusted message content is received through the WeChat long-polling loop and passed to the agent's
chatmethod viaChatRequest.textandChatRequest.mediainSKILL.md. - Boundary markers: The provided implementation examples for OpenAI and custom agents do not utilize delimiters, system instructions, or boundary markers to differentiate between developer instructions and untrusted user input.
- Capability inventory: The skill demonstrates capabilities including local file system reading (
fs.readFileSync) for image processing and external network communication via LLM API calls. - Sanitization: There is no evidence of sanitization, filtering, or validation performed on the incoming WeChat message text before it is appended to the conversation history and sent to the AI backend.
Audit Metadata