wechat-similar-account
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFE
Full Analysis
- [CREDENTIALS_UNSAFE]: The script
scripts/wechat_similar_accountr.pycontains logic to locate theREDFOX_API_KEYby reading local shell configuration files (e.g.,~/.zshrc,~/.bashrc,~/.profile) and the Windows Registry. This behavior is used for automated credential management for the vendor's own API service. - [COMMAND_EXECUTION]: The skill's instructions in
SKILL.mdsuggest the agent help users configure the required API key by executing shell commands that modify local environment configuration files. - [PROMPT_INJECTION]: The skill processes account data and article metadata (titles, summaries) from the external
redfox.hkAPI. While this data is used for legitimate analysis, it represents a potential surface for indirect prompt injection if the source data contains malicious instructions. The analysis identifies ingestion points inscripts/wechat_similar_accountr.pywhere external content is interpolated into markdown without explicit sanitization or boundary markers.
Audit Metadata