create-ex

High-confidence malicious behavior: the script is designed to extract WeChat encryption keys from a running WeChat process (Windows memory scanning and macOS LLDB attachment/ReadMemory, plus implied Keychain access) and then decrypt and write WeChat message databases to disk. This constitutes clear sensitive data theft/confidentiality compromise and potential unauthorized access. It also prints extracted keys to stdout, further increasing impact.

该代码请求描述的是一套端到端的“运行中进程密钥提取 + SQLCipher/WCDB 解密 + 批量聊天导出”的工具设计。其关键实现依赖 lldb attach/断点读取与 Windows 进程内存偏移读取密钥，并要求关闭 macOS SIP/Windows 管理员权限，符合典型的高风险密钥窃取与隐私数据批量导出能力。即使声称仅限导出自己数据，也具备显著可滥用性与恶意复用潜力，因此不应被信任或用于供应链引入。

SUSPICIOUS. The skill's behavior is coherent with its stated goal, but the goal itself requires unusually sensitive access to private message stores and uses unverifiable local decryption/parsing tools. No explicit outbound exfiltration is shown, so this is not confirmed malware, but it is a high-risk privacy and host-data access skill.