wx-cli

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). This is a direct raw GitHub shell script from a personal repository (curl | bash pattern) that requires sudo and performs process-memory scanning and sensitive data extraction for WeChat — running it executes arbitrary code with high privileges and can exfiltrate private data, so it is high risk.

---

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The skill instructs privileged memory scanning and ad-hoc re-signing of the WeChat binary to extract database keys and decrypt message/attachment databases, intentionally bypassing OS privacy controls and producing a local bundle of sensitive secrets (all_keys.json and cached DBs) that enables credential theft and straightforward data exfiltration — a deliberate, high-risk capability.

---

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Outsider-authored free text can enter the agent’s LLM context via runtime ingestion of WeChat chat content (e.g., wx history/search/new-messages/attachments/sns-* output includes message content and sender text authored by other people), which the agent would then pass into the LLM.

---

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's installation instructions include a curl-pipe-to-bash command that fetches and executes remote code at install time (https://raw.githubusercontent.com/jackwener/wx-cli/main/install.sh), which is a high-confidence runtime-executed external dependency.

---

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the skill text for literal, high-entropy credentials.

Flagged: the string "cfcd208495d565ef" appears in the description of the V1 image decoder as the "fixed key" for AES-128-ECB. This is a literal encryption key (used to decrypt image data) and thus qualifies as a secret.

Ignored items:

• Example MD5s like "e05048ca3927c5caf689f54bf57faed0" are just hash examples/derivations, not credentials.
• File paths (e.g., ~/.wx-cli/all_keys.json, daemon.sock) and parameter names are not secret values in the text.
• Commands, config names, and low-entropy words or examples are documentation content, not hardcoded credentials.

Therefore there is at least one real secret present: the fixed AES key "cfcd208495d565ef".

---

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The prompt explicitly instructs running privileged commands (sudo wx init / sudo wx init --force), modifying the WeChat app signature (codesign) and resetting macOS privacy TCC entries (tccutil), and describes scanning process memory to extract DB keys—actions that require elevated privileges and modify system state, so it must be flagged.