Habilidades wechat-local-vault
📦
wechat-local-vault
Revisión del contenido r1 Crítico 📁 Acceso al sistema de archivos🔑 Variables de entorno⚙️ Comandos externos
Analiza tu archivo local de WeChat
Los datos de WeChat para Mac están cifrados y son difíciles de buscar o exportar. Esta habilidad crea una bóveda local para consultas, exportaciones y resúmenes autorizados.
Compatible con: Claude Codex Code(CC)
No instales este Skill automáticamente.
La política canónica exige la revisión de un operador antes de cualquier acción de instalación.
Instalar con mi Agente
Copia esta solicitud en tu Agente. Incluye la página canónica del Skill y el manifiesto.
Solicitud de agente
Review the Skillstore skill "wechat-local-vault" from https://skillstore.io/skills/mcncarl-wechat-local-vault.md and its manifest at https://skillstore.io/api/skills/mcncarl-wechat-local-vault/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.Tu Agente debe seguir mostrando su plan y solicitar cualquier confirmación exigida por la política de seguridad.
Recursos legibles por agentes
Usa estos enlaces cuando un agente de IA, crawler o script necesite contexto limpio en vez de leer la página completa.
Pruébalo
Usando "wechat-local-vault". Comprueba el estado de la bóveda local y muestra solo detalles operativos.
Resultado esperado:
- Hay ocho bases de datos conocidas disponibles y dos requieren claves actualizadas.
- La última actualización correcta se completó hoy.
- Los datos en texto plano permanecen en la bóveda privada configurada.
Usando "wechat-local-vault". Resume el grupo seleccionado entre el 1 y el 7 de mayo.
Resultado esperado:
El resumen cubre 246 mensajes en cuatro temas principales. Enumera dos decisiones, tres preguntas abiertas y los participantes más activos.
Usando "wechat-local-vault". Encuentra seguimientos pendientes de clientes de los últimos 30 días.
Resultado esperado:
Quedan abiertos tres seguimientos. Cada elemento incluye la fecha de la conversación, el compromiso declarado, el estado actual y una recomendación concisa de respuesta.
Auditoría de seguridad
Críticov3 • 11/7/2026 Abrir el informe versionado
The skill intentionally instruments WeChat, captures reusable cryptographic material, decrypts private databases, and exports plaintext conversation data. No application exfiltration was found, but unsafe temporary storage, plaintext keys, generated-source injection, and broad host modifications create serious local risk.
9
Archivos escaneados
3,885
Líneas analizadas
27
Elementos de revisión
0
Falsos positivos ignorados
Preocupaciones de seguridad confirmadas (83)
Crítico
Process Instrumentation Captures Cryptographic Secrets
Frida hooks WeChat key derivation, reads passwords and derived keys from process memory, and records them for database decryption.
The hook explicitly reads password and derived-key pointers, then attaches to or spawns WeChat. The credential extraction intent is direct.
Alto
Captured Secrets Persist in a Predictable Temporary Log
Captured passwords, salts, and derived keys are appended to /tmp/wechat_frida_keys.log. Reuse mode preserves the log without enforcing restrictive permissions.
The embedded hook appends full capture records to a fixed /tmp path. The command option confirms that the log can remain for later reuse.
Alto
Reusable Database Keys Are Stored Unencrypted
Matched SQLCipher keys are saved as plaintext JSON in the user configuration directory. File mode 0600 does not provide encryption at rest.
The matched key dictionary is passed directly to JSON serialization. The only protection applied is a filesystem permission change.
Alto
User-Controlled Path Is Inserted Into Executed Python Source
The --wechat-copy path is inserted into a generated Python string without escaping. A crafted existing path can alter the temporary host program before execution.
The path originates from an unrestricted command-line argument and replaces text inside a quoted Python assignment. The resulting source is executed by the interpreter.
Medio
SQLite database file
"message_0": "message/message_0.db",
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
"message_1": "message/message_1.db",
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
"message_2": "message/message_2.db",
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
"message_3": "message/message_3.db",
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Mostrar los 83 problemas confirmados
Medio
SQLite database file
"message_fts": "message/message_fts.db",
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
"message_resource": "message/message_resource.db",
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
"contact": "contact/contact.db",
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
"session": "session/session.db",
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
"sns": "sns/sns.db",
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
"favorite": "favorite/favorite.db",
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
if name.endswith(".db") and "/" in name:
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
"message/message_0.db",
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
"message/message_1.db",
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
"message/message_2.db",
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
"message/message_3.db",
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
contact_db = decrypted_dir / "contact/contact.db"
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
"message_0": "message/message_0.db",
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
"message_1": "message/message_1.db",
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
"message_2": "message/message_2.db",
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
"message_3": "message/message_3.db",
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
"message_fts": "message/message_fts.db",
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
"message_resource": "message/message_resource.db",
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
"contact": "contact/contact.db",
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
"session": "session/session.db",
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
"sns": "sns/sns.db",
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
"favorite": "favorite/favorite.db",
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
for path in sorted(db_base.rglob("*.db")):
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
wxid, db_base = find_db_base(args.db_base)
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
"message_0": os.path.join(db_base, "message", "message_0.db"),
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
"contact": os.path.join(db_base, "contact", "contact.db"),
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
decrypt_db(path, keys[name], os.path.join(tmp_dir, f"{name}.db"))
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
contacts = get_contact_map(os.path.join(tmp_dir, "contact.db"))
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
hash_map = get_hash_map(os.path.join(tmp_dir, "message_0.db"))
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
db = sqlite3.connect(os.path.join(tmp_dir, "message_0.db"))
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
"contact": os.path.join(db_base, "contact", "contact.db"),
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
"sns": os.path.join(db_base, "sns", "sns.db"),
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
decrypt_db(path, key_hex, os.path.join(tmp_dir, f"{name}.db"))
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
return os.path.join(tmp_dir, "contact.db"), os.path.join(tmp_dir, "sns.db")
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
contact_db = decrypted_dir / "contact/contact.db"
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
return sorted((decrypted_dir / "message").glob("message_*.db"))
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
"contact/contact.db",
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
"session/session.db",
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
"sns/sns.db",
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
"favorite/favorite.db",
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
"message/message_resource.db",
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
session_db = decrypted_dir / "session/session.db"
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
raise SystemExit(f"找不到 session.db,请先增量或全量解密: {session_db}")
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
raise SystemExit("session.db 中没有 SessionTable")
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
contact_db = decrypted_dir / "contact/contact.db"
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
fav_db = decrypted_dir / "favorite/favorite.db"
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
raise SystemExit(f"找不到 favorite.db: {fav_db}")
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
raise SystemExit("favorite.db 中没有 fav_db_item")
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
sns_db = decrypted_dir / "sns/sns.db"
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
raise SystemExit(f"找不到 sns.db: {sns_db}")
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
"message_0": os.path.join(db_base, "message", "message_0.db"),
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
"contact": os.path.join(db_base, "contact", "contact.db"),
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
decrypt_db(path, keys[name], os.path.join(tmp_dir, f"{name}.db"))
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
contacts = get_contact_map(os.path.join(tmp_dir, "contact.db"))
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
hash_map = get_hash_map(os.path.join(tmp_dir, "message_0.db"))
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
db = sqlite3.connect(os.path.join(tmp_dir, "message_0.db"))
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
"message_0": os.path.join(db_base, "message", "message_0.db"),
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
"contact": os.path.join(db_base, "contact", "contact.db"),
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
"session": os.path.join(db_base, "session", "session.db"),
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
decrypt_db(paths[name], key_hex, os.path.join(tmp_dir, f"{name}.db"))
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
contacts = get_contact_map(os.path.join(tmp_dir, "contact.db"))
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
hash_map = get_hash_map(os.path.join(tmp_dir, "message_0.db"))
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
db = sqlite3.connect(os.path.join(tmp_dir, "message_0.db"))
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
contacts = get_contact_map(os.path.join(tmp_dir, "contact.db"))
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
hash_map = get_hash_map(os.path.join(tmp_dir, "message_0.db"))
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
db = sqlite3.connect(os.path.join(tmp_dir, "message_0.db"))
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Medio
SQLite database file
优先使用已解密的 `sns/sns.db`、`favorite/favorite.db`、`message_resource.db`。缺 key 时只补相关库,不全量抓取。输出到用户配置的导出目录。
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Bajo
System reconnaissance
wxid = config.get("wxid")
This line discovers or records a local WeChat account path, identifier, or process needed for instrumentation. The behavior is intentional but exposes host metadata.
Bajo
System reconnaissance
).expanduser() / wxid / "db_storage"
This line discovers or records a local WeChat account path, identifier, or process needed for instrumentation. The behavior is intentional but exposes host metadata.
Bajo
System reconnaissance
pid = device.spawn([WECHAT_PATH])
This line discovers or records a local WeChat account path, identifier, or process needed for instrumentation. The behavior is intentional but exposes host metadata.
Bajo
System reconnaissance
pid = ATTACH_PID
This line discovers or records a local WeChat account path, identifier, or process needed for instrumentation. The behavior is intentional but exposes host metadata.
Bajo
System reconnaissance
wxid = db_base.parts[-2] if db_base.name == "db_storage" else db_base.name
This line discovers or records a local WeChat account path, identifier, or process needed for instrumentation. The behavior is intentional but exposes host metadata.
Bajo
System reconnaissance
wxid = config.get("wxid") or db_base.parts[-2]
This line discovers or records a local WeChat account path, identifier, or process needed for instrumentation. The behavior is intentional but exposes host metadata.
Bajo
System reconnaissance
attach_pid = find_running_process(str(wechat_binary)) if mode == "attach" else 0
This line discovers or records a local WeChat account path, identifier, or process needed for instrumentation. The behavior is intentional but exposes host metadata.
Bajo
System reconnaissance
config["wxid"] = wxid
This line discovers or records a local WeChat account path, identifier, or process needed for instrumentation. The behavior is intentional but exposes host metadata.
Elementos de revisión de capacidades (27)
Estas son capacidades locales reales que pueden esperarse para esta habilidad, por lo que requieren revisión, pero no se cuentan como comportamiento malicioso confirmado.
Alto
Hidden file in home directory
~/.config/wechat-keys.json
This path contains reusable WeChat SQLCipher keys in plaintext JSON. Mode 0600 limits access but does not encrypt the secrets at rest.
Alto
Hidden file in home directory
KEYS_FILE = Path("~/.config/wechat-keys.json").expanduser()
This path contains reusable WeChat SQLCipher keys in plaintext JSON. Mode 0600 limits access but does not encrypt the secrets at rest.
Alto
Hidden file access
~/.config/wechat-keys.json
This path contains reusable WeChat SQLCipher keys in plaintext JSON. Mode 0600 limits access but does not encrypt the secrets at rest.
Alto
Hidden file access
KEYS_FILE = Path("~/.config/wechat-keys.json").expanduser()
This path contains reusable WeChat SQLCipher keys in plaintext JSON. Mode 0600 limits access but does not encrypt the secrets at rest.
Alto
Process spawn
pid = device.spawn([WECHAT_PATH])
Frida spawns and attaches to a signed WeChat executable to intercept key derivation. This is invasive process instrumentation with direct access to secrets.
Alto
Python subprocess.run
result = subprocess.run(cmd, capture_output=True, text=True)
This wrapper runs pip, codesign, and pgrep commands. Arguments use list form, but the commands install software and modify a copied application.
Alto
Python subprocess.run
subprocess.run([sys.executable, host_path], check=True)
This executes a generated Python host script that attaches Frida to WeChat. The script includes raw string substitutions and handles captured cryptographic material.
Alto
Hidden file in home directory
KEYS_FILE = Path("~/.config/wechat-keys.json").expanduser()
This path contains reusable WeChat SQLCipher keys in plaintext JSON. Mode 0600 limits access but does not encrypt the secrets at rest.
Alto
Hidden file access
KEYS_FILE = Path("~/.config/wechat-keys.json").expanduser()
This path contains reusable WeChat SQLCipher keys in plaintext JSON. Mode 0600 limits access but does not encrypt the secrets at rest.
Alto
Temp directory access
FRIDA_LOG = Path("/tmp/wechat_frida_keys.log")
The predictable /tmp log stores captured passwords, salts, and derived keys. Reuse mode intentionally preserves this sensitive material.
Alto
Temp directory access
parser.add_argument("--reuse-log", action="store_true", help="Do not delete /tmp/wechat_frida_keys.l
The predictable /tmp log stores captured passwords, salts, and derived keys. Reuse mode intentionally preserves this sensitive material.
Alto
Hidden file in home directory
KEYS_FILE = os.path.expanduser("~/.config/wechat-keys.json")
This path contains reusable WeChat SQLCipher keys in plaintext JSON. Mode 0600 limits access but does not encrypt the secrets at rest.
Alto
Hidden file access
KEYS_FILE = os.path.expanduser("~/.config/wechat-keys.json")
This path contains reusable WeChat SQLCipher keys in plaintext JSON. Mode 0600 limits access but does not encrypt the secrets at rest.
Alto
Python file write/append
with open(out_path, "wb") as f:
This writes a decrypted SQLite database containing contacts or messages to a persistent local temp directory. The write does not set restrictive file permissions.
Alto
Hidden file in home directory
KEYS_FILE = os.path.expanduser("~/.config/wechat-keys.json")
This path contains reusable WeChat SQLCipher keys in plaintext JSON. Mode 0600 limits access but does not encrypt the secrets at rest.
Alto
Hidden file access
KEYS_FILE = os.path.expanduser("~/.config/wechat-keys.json")
This path contains reusable WeChat SQLCipher keys in plaintext JSON. Mode 0600 limits access but does not encrypt the secrets at rest.
Alto
Python file write/append
with open(out_path, "wb") as f:
This writes a decrypted SQLite database containing contacts or messages to a persistent local temp directory. The write does not set restrictive file permissions.
Alto
Hidden file in home directory
KEYS_FILE = os.path.expanduser("~/.config/wechat-keys.json")
This path contains reusable WeChat SQLCipher keys in plaintext JSON. Mode 0600 limits access but does not encrypt the secrets at rest.
Alto
Hidden file access
KEYS_FILE = os.path.expanduser("~/.config/wechat-keys.json")
This path contains reusable WeChat SQLCipher keys in plaintext JSON. Mode 0600 limits access but does not encrypt the secrets at rest.
Alto
Python file write/append
with open(out_path, "wb") as f:
This writes a decrypted SQLite database containing contacts or messages to a persistent local temp directory. The write does not set restrictive file permissions.
Alto
Hidden file in home directory
2. 如果 `~/.config/wechat-keys.json` 已有 key,先用 `--match-only --targets all --reuse-log` 尝试复用。
This path contains reusable WeChat SQLCipher keys in plaintext JSON. Mode 0600 limits access but does not encrypt the secrets at rest.
Alto
Hidden file access
2. 如果 `~/.config/wechat-keys.json` 已有 key,先用 `--match-only --targets all --reuse-log` 尝试复用。
This path contains reusable WeChat SQLCipher keys in plaintext JSON. Mode 0600 limits access but does not encrypt the secrets at rest.
Medio
Python shutil operations
shutil.rmtree(out_base)
The --clean option recursively deletes the user-selected output path without a vault-boundary check. A mistaken path can destroy unrelated files.
Medio
Python shutil operations
shutil.copytree(WECHAT_APP, copy_path, symlinks=True)
The script copies the complete WeChat application before ad-hoc signing it. This is deliberate host modification with substantial filesystem impact.
Medio
Python file write/append
with open(report_path, "w", encoding="utf-8") as f:
This writes a readable report containing private conversation content to a configured directory. The operation is expected but creates a confidentiality risk.
Medio
Python file write/append
with open(report_path, "w", encoding="utf-8") as f:
This writes a readable report containing private conversation content to a configured directory. The operation is expected but creates a confidentiality risk.
Bajo
Python glob/pattern matching
dirs = sorted(glob.glob(str(WECHAT_BASE / "*/db_storage")))
The glob enumerates WeChat account database directories and derives a local account identifier. This is intentional local data discovery.
Factores de riesgo
📁 Acceso al sistema de archivos (50)
scripts/decrypt_all_dbs.py:6 scripts/decrypt_all_dbs.py:7 scripts/decrypt_all_dbs.py:32 scripts/decrypt_all_dbs.py:33 scripts/decrypt_all_dbs.py:6 scripts/decrypt_all_dbs.py:7 scripts/decrypt_all_dbs.py:32 scripts/decrypt_all_dbs.py:33 scripts/decrypt_all_dbs.py:229 scripts/decrypt_all_dbs.py:69 scripts/decrypt_all_dbs.py:73 scripts/decrypt_all_dbs.py:83 scripts/export_chat.py:26 scripts/export_chat.py:26 scripts/export_chat.py:72 scripts/export_chat.py:76 scripts/extract_keys.py:24 scripts/extract_keys.py:25 scripts/extract_keys.py:24 scripts/extract_keys.py:25 scripts/extract_keys.py:28 scripts/extract_keys.py:635 scripts/extract_keys.py:19 scripts/extract_keys.py:431 scripts/extract_keys.py:319 scripts/extract_keys.py:283 scripts/extract_keys.py:441 scripts/extract_keys.py:339 scripts/list_contacts.py:14 scripts/list_contacts.py:15 scripts/list_contacts.py:95 scripts/list_contacts.py:14 scripts/list_contacts.py:15 scripts/list_contacts.py:95 scripts/list_contacts.py:68 scripts/list_contacts.py:100 scripts/search_sns.py:25 scripts/search_sns.py:26 scripts/search_sns.py:25 scripts/search_sns.py:26 scripts/search_sns.py:75 scripts/search_sns.py:83 scripts/vault_cli.py:29 scripts/vault_cli.py:29 scripts/vault_cli.py:94 scripts/wechat_digest.py:15 scripts/wechat_digest.py:16 scripts/wechat_digest.py:61 scripts/wechat_digest.py:15 scripts/wechat_digest.py:16
🔑 Variables de entorno (19)
scripts/decrypt_all_dbs.py:93 scripts/decrypt_all_dbs.py:95 scripts/export_chat.py:83 scripts/export_chat.py:84 scripts/extract_keys.py:334 scripts/extract_keys.py:336 scripts/list_contacts.py:31 scripts/list_contacts.py:33 scripts/search_sns.py:43 scripts/search_sns.py:45 scripts/vault_cli.py:105 scripts/vault_cli.py:110 scripts/vault_cli.py:115 scripts/vault_cli.py:117 scripts/wechat_digest.py:54 scripts/wechat_digest.py:56 scripts/wechat_digest.py:67 scripts/wechat_digest.py:295 scripts/wechat_digest.py:296
⚙️ Comandos externos (50)
scripts/extract_keys.py:218 scripts/extract_keys.py:256 scripts/extract_keys.py:436 scripts/wechat_digest.py:334 SKILL.md:9 SKILL.md:32 SKILL.md:33 SKILL.md:37 SKILL.md:39-52 SKILL.md:52-54 SKILL.md:54 SKILL.md:60-63 SKILL.md:63-65 SKILL.md:65-67 SKILL.md:67-68 SKILL.md:68-69 SKILL.md:69 SKILL.md:70-71 SKILL.md:71-73 SKILL.md:73-79 SKILL.md:79-81 SKILL.md:81-85 SKILL.md:85-87 SKILL.md:87-91 SKILL.md:91-93 SKILL.md:93-97 SKILL.md:97-99 SKILL.md:99-103 SKILL.md:103-105 SKILL.md:105-109 SKILL.md:109-111 SKILL.md:111-115 SKILL.md:115-117 SKILL.md:117-121 SKILL.md:121-123 SKILL.md:123-125 SKILL.md:125-133 SKILL.md:133-134 SKILL.md:134 SKILL.md:136-143 SKILL.md:143-144 SKILL.md:144-146 SKILL.md:146-152 SKILL.md:152-153 SKILL.md:153-159 SKILL.md:159 SKILL.md:164 SKILL.md:165-166 SKILL.md:166 SKILL.md:169-170
Patrones detectados
System reconnaissance×8
Auditado por: codex Ver historial de auditorías →
Compartir y citar este informe
Comparte el informe de evaluación versionado, la insignia neutral, la tarjeta insertable y las citas. Skillstore presenta evidencias sin decidir si este Skill es seguro.
Copiar enlace del informe
https://skillstore.io/skills/mcncarl-wechat-local-vault/audits/3?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportInsignia Markdown
[](https://skillstore.io/skills/mcncarl-wechat-local-vault?utm_source=security_passport_badge)Insignia HTML
<a href="https://skillstore.io/skills/mcncarl-wechat-local-vault?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/mcncarl-wechat-local-vault/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Tarjeta para insertar
<iframe src="https://skillstore.io/embed/skills/mcncarl-wechat-local-vault.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Citas académicas (APA · BibTeX · CFF)
Cita APA
mcncarl. (2026). wechat-local-vault security audit report (audit version 3) [Author version unspecified]. Skillstore. https://skillstore.io/skills/mcncarl-wechat-local-vault/audits/3Cita BibTeX
@techreport{mcncarl-mcncarl-wechat-local-vault-2026,
author = {mcncarl},
title = {wechat-local-vault security audit report (audit version 3)},
institution = {Skillstore},
year = {2026},
number = {3},
url = {https://skillstore.io/skills/mcncarl-wechat-local-vault/audits/3},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "wechat-local-vault security audit report (audit version 3)"
version: "unspecified"
type: report
authors:
- name: "mcncarl"
date-released: "2026-07-11"
url: "https://skillstore.io/skills/mcncarl-wechat-local-vault/audits/3"
identifiers:
- type: other
value: "skillstore:mcncarl-wechat-local-vault:audit:3"
description: "Skillstore immutable audit report identifier"
Puntuación de Skillstore
Por qué esta puntuación Confianza de la evidencia: Medio 59
Arquitectura
85
Mantenibilidad
87
Contenido
65
Comunidad
83
Cumplimiento de la especificación
Lo que puedes crear
Revisar una conversación personal
Exporta una conversación autorizada y analiza su cronología, tono, decisiones y elementos de seguimiento.
Preparar un resumen de grupo
Crea un paquete de fuentes acotado y resume temas, participación, decisiones y preguntas sin resolver.
Hacer seguimiento a clientes
Busca en chats autorizados con clientes compromisos, preguntas sin respuesta y actividad reciente dentro de un período definido.
Prueba estos prompts
Comprobar el estado de la bóveda
Comprueba el estado de mi bóveda local autorizada de WeChat. Informa sobre las bases de datos disponibles, las claves faltantes, la actualidad de los datos y las ubicaciones de salida sensibles para la privacidad.
Exportar una conversación
Exporta mi conversación con [contact or group] desde [start date] hasta [end date]. Usa el alcance mínimo necesario y guarda un informe legible.
Crear un resumen de grupo
Crea un paquete de fuentes para el resumen de [group] que cubra [date range]. Resume los temas principales, las decisiones, los participantes y los elementos sin resolver sin exponer mensajes innecesarios.
Analizar el riesgo de seguimiento
Busca en los chats autorizados con [customer] durante los últimos [period]. Identifica compromisos, preguntas sin respuesta, cambios de sentimiento y seguimientos recomendados con fechas de respaldo.
Mejores prácticas
- Confirma la propiedad y la autorización antes de acceder a cualquier cuenta o conversación de WeChat.
- Usa contactos e intervalos de fechas restringidos antes de realizar un descifrado completo o exportaciones amplias.
- Mantén las claves, las bases de datos en texto plano y los informes en directorios locales privados con permisos restrictivos.
Evitar
- No inspecciones la cuenta, el dispositivo ni las conversaciones de otra persona sin autorización explícita.
- No coloques bases de datos en texto plano ni claves reutilizables en carpetas compartidas, repositorios o almacenamiento en la nube.
- No solicites archivos completos cuando una conversación o un intervalo de fechas acotado responde a la pregunta.
Preguntas frecuentes
¿Qué versiones de WeChat son compatibles?
Los scripts están dirigidos a los diseños de WeChat para Mac 4.x. Las actualizaciones de la aplicación pueden cambiar los esquemas de las bases de datos o el comportamiento de derivación de claves.
¿La habilidad envía datos a través de la red?
No se encontraron solicitudes de red de la aplicación. La instalación de dependencias puede contactar repositorios de paquetes de Python cuando faltan paquetes requeridos.
¿Dónde se almacenan las bases de datos descifradas?
La bóveda predeterminada se encuentra en el directorio local Application Support. La configuración puede seleccionar otra ruta local.
¿Puede leer el contenido de las imágenes?
No. Puede indexar mensajes de imagen, pero los resúmenes requieren descripciones de imágenes independientes para describir el contenido visual.
¿Es segura la extracción de claves?
Instrumenta una copia firmada de WeChat y captura material criptográfico. Ejecútala solo en un dispositivo autorizado después de revisar las advertencias de seguridad.
¿Puede actualizar solo los datos recientes?
Sí. El modo incremental omite las bases de datos sin cambios y puede exportar conversaciones seleccionadas desde un momento especificado.
Detalles del desarrollador
Autor
mcncarlLicencia
MIT
Revisión de Skillstore
r1
Aviso de versión
El autor no declaró una versión.
Ref.
c0271103e9d6ff62c5aa5b85e8fbc03aad6fc662
Actualidad del mantenimiento
18/7/2026
Uso
8 descargas · 1 vistas
Estructura de archivos