The Agent Skills Directory

[DATA_EXFILTRATION]: The skill accesses highly sensitive personal information stored in local WeChat databases.
Evidence: The script scripts/wechat.py and documentation in SKILL.md target databases located at ~/Library/Containers/com.tencent.xinWeChat/ (macOS) and Documents/WeChat Files/ (Windows).
Impact: These databases contain comprehensive records of private messages, contact lists, and favorites, posing a significant data exposure risk.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from chat messages that could contain malicious instructions designed to hijack the agent's behavior.
Ingestion points: The scripts/wechat.py script reads message content from the Chat_ftsMessage and FavItem tables.
Boundary markers: The skill does not implement delimiters or provide system instructions to the agent to disregard instructions embedded within the retrieved messages.
Capability inventory: The agent has the capability to read files, search SQLite data, and list contacts, which could be abused if the agent is influenced by malicious message content.
Sanitization: There is no evidence of content filtering, escaping, or sanitization before the retrieved message data is presented to the agent.

wechat