remote-control
Pass
Audited by Gen Agent Trust Hub on Jun 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill instructs the agent to suppress standard terminal output and confirmation messages ("不要输出任何说明或询问用户", "禁止的行为: 输出元信息"), which reduces user visibility into the agent's autonomous actions and bypasses standard interaction loops.\n- [DATA_EXFILTRATION]: The skill is designed to export task summaries and full session transcripts (potentially containing sensitive code) to a remote WeChat ID and a user-configured 'transcript_domain'. This exposes local workspace data to external infrastructure.\n- [COMMAND_EXECUTION]: The skill establishes an autonomous loop that waits for remote instructions and executes them directly using the 'Bash' tool, effectively allowing remote code execution via the WeChat interface.\n- [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface by design, as it treats all remote input as valid instructions without verification.\n
- Ingestion points: External messages received via the 'gewe-cc wait-reply' command in SKILL.md.\n
- Boundary markers: None present; the skill explicitly directs the agent to "将回复作为新任务执行".\n
- Capability inventory: Full 'Bash' tool access allowing arbitrary shell commands.\n
- Sanitization: None; the instructions lack any validation, escaping, or filtering of the remote input before it is processed as a task.
Audit Metadata