Security Audit

jimliu/baoyu-skills:skills/baoyu-wechat-summary

github.com/jimliu/baoyu-skills

AI SkillCommit 6b7a2e417500

CAUTION

Scanned 24 days ago

Critical

Immediate action required

High

Priority fixes suggested

Medium

Best practices review

Low

Acknowledged / Tracked

Trust Assessment

jimliu/baoyu-skills:skills/baoyu-wechat-summary received a trust score of 58/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.

SkillShield's automated analysis identified 3 findings: 1 critical, 1 high, 1 medium, and 0 low severity. Key findings include Sensitive environment variable access: $HOME, Command Injection via Untrusted Group Name in Shell Commands, Instruction to Disable Sandbox (`dangerouslyDisableSandbox: true`).

The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The LLM Behavioral Safety layer scored lowest at 55/100, indicating areas for improvement.

Last analyzed on August 6, 2026 (commit 6b7a2e41). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.

Layer Breakdown

Manifest Analysis

100%

Static Code Analysis

93%

Dependency Graph

100%

LLM Behavioral Safety

55%

Behavioral Risk Signals

Network Access

1 finding

Filesystem Write

1 finding

Shell Execution

3 findings

Dynamic Code

2 findings

Excessive Permissions

2 findings

Security Findings3

Severity	Finding	Layer	Location
CRITICAL	Command Injection via Untrusted Group Name in Shell Commands The skill instructs the LLM to execute shell commands (such as `wx contacts --query "<group_name>" --json` and `wx members "<group_name_or_id>" --json`) using group names or IDs extracted directly from user input or external WeChat data. If a group name contains shell metacharacters (e.g., `;`, `&&`, `\|`, `$()`), it can lead to arbitrary command execution on the host system. This is extremely dangerous because the skill explicitly instructs the LLM to run these commands with the sandbox disabled. Avoid direct shell interpolation of untrusted inputs. Sanitize all group names and IDs to ensure they only contain alphanumeric characters or safe symbols before passing them to shell commands, or use safe argument-passing APIs that bypass shell parsing.	LLM	SKILL.md:105
HIGH	Instruction to Disable Sandbox (`dangerouslyDisableSandbox: true`) The skill explicitly instructs the host LLM to run all `wx` commands with `dangerouslyDisableSandbox: true` to access paths outside the default sandbox (such as `~/.wx-cli/` and WeChat's data directory). Disabling the sandbox globally for commands that process untrusted inputs (like WeChat group names and message contents) significantly increases the risk of host compromise via command injection. Do not disable the sandbox globally. Instead, restrict the file paths that the sandbox can access, or use a secure, sandboxed helper tool to interface with the local `wx-cli` binary without exposing the entire host system.	LLM	SKILL.md:8
MEDIUM	Sensitive environment variable access: $HOME Access to sensitive environment variable '$HOME' detected in shell context. Verify this environment variable access is necessary and the value is not exfiltrated.	Static	skills/baoyu-wechat-summary/SKILL.md:42

Scan History

Embed Code

[![SkillShield](https://skillshield.io/api/v1/badge/f89bf9417e5ba7e8.svg)](https://skillshield.io/report/f89bf9417e5ba7e8)