Why this verdict
- benign: 187 checks satisfied, no findings for skill:skills/baoyu-wechat-summary
Security findings 0
No security findings
No suspicious or malicious behavior was found; 4 candidate findings were refuted on review.
Refuted findings 4
Candidates the review stage examined and rejected, kept for transparency.
Privilege escalation
highRefutedlow confidenceThe setup instructions direct the agent to have the user ad-hoc re-sign the WeChat application (codesign --force --deep --sign -), stripping the app's code-signing protections so that wx-cli can access its data, a permission-bypass step executed by the user whose full effect is asserted but unverifiable from the artifact.
codesign --force --deep --sign - /Applications/WeChat.app
Why it was refuted
The codesign step is a user-executed prerequisite that the skill merely relays for its declared wrapped dependency wx-cli (declared claims D64/D65), and the setup doc explicitly refuses to run privileged steps itself, so the behavior is declared and instrumental to the declared core capability rather than an agent-side privilege bypass.
Privilege escalation
highRefutedmedium confidenceThe skill's troubleshooting table instructs the agent to bypass sandboxing by re-running wx commands with dangerouslyDisableSandbox: true and persistently allowlisting ~/.wx-cli and the WeChat data dir via /sandbox whenever sandbox denials occur, removing the sandbox boundary around a tool that reads WeChat's local message store.
Re-run the command with `dangerouslyDisableSandbox: true`. Persistent fix: `/sandbox` to allow `~/.wx-cli` and the WeChat data dir.
Why it was refuted
The troubleshooting row repeats the same declared, scoped exception (D66/D67): it fires only on sandbox denials for wx-cli's own data paths, the persistent fix routes through the user's own /sandbox control limited to ~/.wx-cli and the WeChat data dir, and the skill body already declares these paths sit outside the sandbox — the declared-core-capability carve-out applies and the declaration defeats the undeclared gate.
Privilege escalation
highRefutedhigh confidenceThe skill's header instructs the agent to run every wx command with dangerouslyDisableSandbox:true from the first attempt and points to /sandbox as a persistent sandbox exception, disabling the agent's sandbox protection so wx-cli can read WeChat data outside the sandbox.
Every `wx` command in this skill needs to run with `dangerouslyDisableSandbox: true` from the start — don't waste a sandbox attempt first
Why it was refuted
The sandbox bypass is an openly declared mandatory capability claim (D3) in the skill body, scoped to `wx` commands and justified by the same paragraph because wx-cli's config/cache and WeChat data paths sit outside the default sandbox. That places it under the declared-core-capability carve-out, and the explicit declaration defeats the undeclared gate; the /sandbox reference is offered to the user to view/edit restrictions, not a concealed exception.
Privilege escalation
highRefutedmedium confidenceThe skill instructs the agent to run every wx command with dangerouslyDisableSandbox: true from the start and to re-run failed commands with it as well, disabling the sandbox for the whole wx-cli workflow; this is openly declared (D3) and plausibly needed for wx-cli's file access, but it is a real permission-bypass that removes sandbox protections beyond narrow necessity.
Every `wx` command in this skill needs to run with `dangerouslyDisableSandbox: true` from the start
Why it was refuted
The same body paragraph declares the flag requirement as a capability (D3) and shows it is narrowly necessary: every `wx` command reads paths outside the sandbox, so the 'beyond narrow necessity' characterization is contradicted and the carve-out for the declared core capability applies. The behavior is declared, not concealed, and is scoped to `wx` commands only.
Coverage gaps 1
Parts of the artifact the static analysis could not fully examine.
context:unanalyzable_binary binary content is only byte-scanned
bun.lockb
