Навыки wechat-local-vault
📦
wechat-local-vault
Ревизия содержимого r1 Критично 📁 Доступ к файловой системе🔑 Переменные окружения⚙️ Внешние команды
Анализ локального архива WeChat
Данные WeChat на Mac зашифрованы, поэтому их сложно искать и экспортировать. Этот навык создает локальное хранилище для авторизованных запросов, экспорта и сводок.
Поддерживает: Claude Codex Code(CC)
Не устанавливайте этот Skill автоматически.
Каноническая политика требует проверки оператором перед любым действием по установке.
Установить с помощью моего Агента
Скопируйте этот запрос в своего Агента. Он содержит каноническую страницу Skill и манифест.
Запрос агента
Review the Skillstore skill "wechat-local-vault" from https://skillstore.io/skills/mcncarl-wechat-local-vault.md and its manifest at https://skillstore.io/api/skills/mcncarl-wechat-local-vault/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.Ваш Агент по-прежнему должен показать план и запросить все подтверждения, требуемые политикой безопасности.
Ресурсы для AI-агентов
Используйте эти ссылки, когда AI-агенту, crawler или script нужен чистый контекст вместо полной страницы.
Протестировать
Использование «wechat-local-vault». Проверь состояние локального хранилища и покажи только технические сведения.
Ожидаемый результат:
- Доступны восемь известных баз данных, для двух из них требуются обновленные ключи.
- Последнее успешное обновление завершилось сегодня.
- Незашифрованные данные остаются в настроенном приватном хранилище.
Использование «wechat-local-vault». Составь сводку по выбранной группе за период с 1 по 7 мая.
Ожидаемый результат:
Сводка охватывает 246 сообщений по четырем основным темам. В ней перечислены два решения, три открытых вопроса и наиболее активные участники.
Использование «wechat-local-vault». Найди ожидающие выполнения действия по работе с клиентами за последние 30 дней.
Ожидаемый результат:
Открытыми остаются три действия. Для каждого указаны дата беседы, заявленное обязательство, текущий статус и краткая рекомендация по ответу.
Аудит безопасности
Критичноv3 • 11.07.2026 Открыть версионный отчет
The skill intentionally instruments WeChat, captures reusable cryptographic material, decrypts private databases, and exports plaintext conversation data. No application exfiltration was found, but unsafe temporary storage, plaintext keys, generated-source injection, and broad host modifications create serious local risk.
9
Просканировано файлов
3,885
Проанализировано строк
27
Пункты проверки
0
Ложные срабатывания проигнорированы
Подтверждённые проблемы безопасности (83)
Критично
Process Instrumentation Captures Cryptographic Secrets
Frida hooks WeChat key derivation, reads passwords and derived keys from process memory, and records them for database decryption.
The hook explicitly reads password and derived-key pointers, then attaches to or spawns WeChat. The credential extraction intent is direct.
Высокий
Captured Secrets Persist in a Predictable Temporary Log
Captured passwords, salts, and derived keys are appended to /tmp/wechat_frida_keys.log. Reuse mode preserves the log without enforcing restrictive permissions.
The embedded hook appends full capture records to a fixed /tmp path. The command option confirms that the log can remain for later reuse.
Высокий
Reusable Database Keys Are Stored Unencrypted
Matched SQLCipher keys are saved as plaintext JSON in the user configuration directory. File mode 0600 does not provide encryption at rest.
The matched key dictionary is passed directly to JSON serialization. The only protection applied is a filesystem permission change.
Высокий
User-Controlled Path Is Inserted Into Executed Python Source
The --wechat-copy path is inserted into a generated Python string without escaping. A crafted existing path can alter the temporary host program before execution.
The path originates from an unrestricted command-line argument and replaces text inside a quoted Python assignment. The resulting source is executed by the interpreter.
Средний
SQLite database file
"message_0": "message/message_0.db",
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
"message_1": "message/message_1.db",
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
"message_2": "message/message_2.db",
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
"message_3": "message/message_3.db",
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Показать все подтверждённые находки (83)
Средний
SQLite database file
"message_fts": "message/message_fts.db",
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
"message_resource": "message/message_resource.db",
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
"contact": "contact/contact.db",
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
"session": "session/session.db",
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
"sns": "sns/sns.db",
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
"favorite": "favorite/favorite.db",
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
if name.endswith(".db") and "/" in name:
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
"message/message_0.db",
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
"message/message_1.db",
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
"message/message_2.db",
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
"message/message_3.db",
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
contact_db = decrypted_dir / "contact/contact.db"
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
"message_0": "message/message_0.db",
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
"message_1": "message/message_1.db",
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
"message_2": "message/message_2.db",
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
"message_3": "message/message_3.db",
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
"message_fts": "message/message_fts.db",
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
"message_resource": "message/message_resource.db",
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
"contact": "contact/contact.db",
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
"session": "session/session.db",
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
"sns": "sns/sns.db",
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
"favorite": "favorite/favorite.db",
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
for path in sorted(db_base.rglob("*.db")):
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
wxid, db_base = find_db_base(args.db_base)
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
"message_0": os.path.join(db_base, "message", "message_0.db"),
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
"contact": os.path.join(db_base, "contact", "contact.db"),
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
decrypt_db(path, keys[name], os.path.join(tmp_dir, f"{name}.db"))
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
contacts = get_contact_map(os.path.join(tmp_dir, "contact.db"))
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
hash_map = get_hash_map(os.path.join(tmp_dir, "message_0.db"))
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
db = sqlite3.connect(os.path.join(tmp_dir, "message_0.db"))
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
"contact": os.path.join(db_base, "contact", "contact.db"),
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
"sns": os.path.join(db_base, "sns", "sns.db"),
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
decrypt_db(path, key_hex, os.path.join(tmp_dir, f"{name}.db"))
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
return os.path.join(tmp_dir, "contact.db"), os.path.join(tmp_dir, "sns.db")
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
contact_db = decrypted_dir / "contact/contact.db"
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
return sorted((decrypted_dir / "message").glob("message_*.db"))
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
"contact/contact.db",
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
"session/session.db",
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
"sns/sns.db",
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
"favorite/favorite.db",
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
"message/message_resource.db",
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
session_db = decrypted_dir / "session/session.db"
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
raise SystemExit(f"找不到 session.db,请先增量或全量解密: {session_db}")
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
raise SystemExit("session.db 中没有 SessionTable")
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
contact_db = decrypted_dir / "contact/contact.db"
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
fav_db = decrypted_dir / "favorite/favorite.db"
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
raise SystemExit(f"找不到 favorite.db: {fav_db}")
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
raise SystemExit("favorite.db 中没有 fav_db_item")
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
sns_db = decrypted_dir / "sns/sns.db"
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
raise SystemExit(f"找不到 sns.db: {sns_db}")
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
"message_0": os.path.join(db_base, "message", "message_0.db"),
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
"contact": os.path.join(db_base, "contact", "contact.db"),
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
decrypt_db(path, keys[name], os.path.join(tmp_dir, f"{name}.db"))
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
contacts = get_contact_map(os.path.join(tmp_dir, "contact.db"))
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
hash_map = get_hash_map(os.path.join(tmp_dir, "message_0.db"))
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
db = sqlite3.connect(os.path.join(tmp_dir, "message_0.db"))
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
"message_0": os.path.join(db_base, "message", "message_0.db"),
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
"contact": os.path.join(db_base, "contact", "contact.db"),
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
"session": os.path.join(db_base, "session", "session.db"),
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
decrypt_db(paths[name], key_hex, os.path.join(tmp_dir, f"{name}.db"))
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
contacts = get_contact_map(os.path.join(tmp_dir, "contact.db"))
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
hash_map = get_hash_map(os.path.join(tmp_dir, "message_0.db"))
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
db = sqlite3.connect(os.path.join(tmp_dir, "message_0.db"))
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
contacts = get_contact_map(os.path.join(tmp_dir, "contact.db"))
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
hash_map = get_hash_map(os.path.join(tmp_dir, "message_0.db"))
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
db = sqlite3.connect(os.path.join(tmp_dir, "message_0.db"))
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Средний
SQLite database file
优先使用已解密的 `sns/sns.db`、`favorite/favorite.db`、`message_resource.db`。缺 key 时只补相关库,不全量抓取。输出到用户配置的导出目录。
This references, decrypts, or queries WeChat databases containing messages, contacts, sessions, Moments, or Favorites. Authorized functionality still exposes highly private local data.
Низкий
System reconnaissance
wxid = config.get("wxid")
This line discovers or records a local WeChat account path, identifier, or process needed for instrumentation. The behavior is intentional but exposes host metadata.
Низкий
System reconnaissance
).expanduser() / wxid / "db_storage"
This line discovers or records a local WeChat account path, identifier, or process needed for instrumentation. The behavior is intentional but exposes host metadata.
Низкий
System reconnaissance
pid = device.spawn([WECHAT_PATH])
This line discovers or records a local WeChat account path, identifier, or process needed for instrumentation. The behavior is intentional but exposes host metadata.
Низкий
System reconnaissance
pid = ATTACH_PID
This line discovers or records a local WeChat account path, identifier, or process needed for instrumentation. The behavior is intentional but exposes host metadata.
Низкий
System reconnaissance
wxid = db_base.parts[-2] if db_base.name == "db_storage" else db_base.name
This line discovers or records a local WeChat account path, identifier, or process needed for instrumentation. The behavior is intentional but exposes host metadata.
Низкий
System reconnaissance
wxid = config.get("wxid") or db_base.parts[-2]
This line discovers or records a local WeChat account path, identifier, or process needed for instrumentation. The behavior is intentional but exposes host metadata.
Низкий
System reconnaissance
attach_pid = find_running_process(str(wechat_binary)) if mode == "attach" else 0
This line discovers or records a local WeChat account path, identifier, or process needed for instrumentation. The behavior is intentional but exposes host metadata.
Низкий
System reconnaissance
config["wxid"] = wxid
This line discovers or records a local WeChat account path, identifier, or process needed for instrumentation. The behavior is intentional but exposes host metadata.
Пункты проверки возможностей (27)
Это реальные локальные возможности, которые могут ожидаться для этого навыка, поэтому они требуют проверки, но не считаются подтверждённым вредоносным поведением.
Высокий
Hidden file in home directory
~/.config/wechat-keys.json
This path contains reusable WeChat SQLCipher keys in plaintext JSON. Mode 0600 limits access but does not encrypt the secrets at rest.
Высокий
Hidden file in home directory
KEYS_FILE = Path("~/.config/wechat-keys.json").expanduser()
This path contains reusable WeChat SQLCipher keys in plaintext JSON. Mode 0600 limits access but does not encrypt the secrets at rest.
Высокий
Hidden file access
~/.config/wechat-keys.json
This path contains reusable WeChat SQLCipher keys in plaintext JSON. Mode 0600 limits access but does not encrypt the secrets at rest.
Высокий
Hidden file access
KEYS_FILE = Path("~/.config/wechat-keys.json").expanduser()
This path contains reusable WeChat SQLCipher keys in plaintext JSON. Mode 0600 limits access but does not encrypt the secrets at rest.
Высокий
Process spawn
pid = device.spawn([WECHAT_PATH])
Frida spawns and attaches to a signed WeChat executable to intercept key derivation. This is invasive process instrumentation with direct access to secrets.
Высокий
Python subprocess.run
result = subprocess.run(cmd, capture_output=True, text=True)
This wrapper runs pip, codesign, and pgrep commands. Arguments use list form, but the commands install software and modify a copied application.
Высокий
Python subprocess.run
subprocess.run([sys.executable, host_path], check=True)
This executes a generated Python host script that attaches Frida to WeChat. The script includes raw string substitutions and handles captured cryptographic material.
Высокий
Hidden file in home directory
KEYS_FILE = Path("~/.config/wechat-keys.json").expanduser()
This path contains reusable WeChat SQLCipher keys in plaintext JSON. Mode 0600 limits access but does not encrypt the secrets at rest.
Высокий
Hidden file access
KEYS_FILE = Path("~/.config/wechat-keys.json").expanduser()
This path contains reusable WeChat SQLCipher keys in plaintext JSON. Mode 0600 limits access but does not encrypt the secrets at rest.
Высокий
Temp directory access
FRIDA_LOG = Path("/tmp/wechat_frida_keys.log")
The predictable /tmp log stores captured passwords, salts, and derived keys. Reuse mode intentionally preserves this sensitive material.
Высокий
Temp directory access
parser.add_argument("--reuse-log", action="store_true", help="Do not delete /tmp/wechat_frida_keys.l
The predictable /tmp log stores captured passwords, salts, and derived keys. Reuse mode intentionally preserves this sensitive material.
Высокий
Hidden file in home directory
KEYS_FILE = os.path.expanduser("~/.config/wechat-keys.json")
This path contains reusable WeChat SQLCipher keys in plaintext JSON. Mode 0600 limits access but does not encrypt the secrets at rest.
Высокий
Hidden file access
KEYS_FILE = os.path.expanduser("~/.config/wechat-keys.json")
This path contains reusable WeChat SQLCipher keys in plaintext JSON. Mode 0600 limits access but does not encrypt the secrets at rest.
Высокий
Python file write/append
with open(out_path, "wb") as f:
This writes a decrypted SQLite database containing contacts or messages to a persistent local temp directory. The write does not set restrictive file permissions.
Высокий
Hidden file in home directory
KEYS_FILE = os.path.expanduser("~/.config/wechat-keys.json")
This path contains reusable WeChat SQLCipher keys in plaintext JSON. Mode 0600 limits access but does not encrypt the secrets at rest.
Высокий
Hidden file access
KEYS_FILE = os.path.expanduser("~/.config/wechat-keys.json")
This path contains reusable WeChat SQLCipher keys in plaintext JSON. Mode 0600 limits access but does not encrypt the secrets at rest.
Высокий
Python file write/append
with open(out_path, "wb") as f:
This writes a decrypted SQLite database containing contacts or messages to a persistent local temp directory. The write does not set restrictive file permissions.
Высокий
Hidden file in home directory
KEYS_FILE = os.path.expanduser("~/.config/wechat-keys.json")
This path contains reusable WeChat SQLCipher keys in plaintext JSON. Mode 0600 limits access but does not encrypt the secrets at rest.
Высокий
Hidden file access
KEYS_FILE = os.path.expanduser("~/.config/wechat-keys.json")
This path contains reusable WeChat SQLCipher keys in plaintext JSON. Mode 0600 limits access but does not encrypt the secrets at rest.
Высокий
Python file write/append
with open(out_path, "wb") as f:
This writes a decrypted SQLite database containing contacts or messages to a persistent local temp directory. The write does not set restrictive file permissions.
Высокий
Hidden file in home directory
2. 如果 `~/.config/wechat-keys.json` 已有 key,先用 `--match-only --targets all --reuse-log` 尝试复用。
This path contains reusable WeChat SQLCipher keys in plaintext JSON. Mode 0600 limits access but does not encrypt the secrets at rest.
Высокий
Hidden file access
2. 如果 `~/.config/wechat-keys.json` 已有 key,先用 `--match-only --targets all --reuse-log` 尝试复用。
This path contains reusable WeChat SQLCipher keys in plaintext JSON. Mode 0600 limits access but does not encrypt the secrets at rest.
Средний
Python shutil operations
shutil.rmtree(out_base)
The --clean option recursively deletes the user-selected output path without a vault-boundary check. A mistaken path can destroy unrelated files.
Средний
Python shutil operations
shutil.copytree(WECHAT_APP, copy_path, symlinks=True)
The script copies the complete WeChat application before ad-hoc signing it. This is deliberate host modification with substantial filesystem impact.
Средний
Python file write/append
with open(report_path, "w", encoding="utf-8") as f:
This writes a readable report containing private conversation content to a configured directory. The operation is expected but creates a confidentiality risk.
Средний
Python file write/append
with open(report_path, "w", encoding="utf-8") as f:
This writes a readable report containing private conversation content to a configured directory. The operation is expected but creates a confidentiality risk.
Низкий
Python glob/pattern matching
dirs = sorted(glob.glob(str(WECHAT_BASE / "*/db_storage")))
The glob enumerates WeChat account database directories and derives a local account identifier. This is intentional local data discovery.
Факторы риска
📁 Доступ к файловой системе (50)
scripts/decrypt_all_dbs.py:6 scripts/decrypt_all_dbs.py:7 scripts/decrypt_all_dbs.py:32 scripts/decrypt_all_dbs.py:33 scripts/decrypt_all_dbs.py:6 scripts/decrypt_all_dbs.py:7 scripts/decrypt_all_dbs.py:32 scripts/decrypt_all_dbs.py:33 scripts/decrypt_all_dbs.py:229 scripts/decrypt_all_dbs.py:69 scripts/decrypt_all_dbs.py:73 scripts/decrypt_all_dbs.py:83 scripts/export_chat.py:26 scripts/export_chat.py:26 scripts/export_chat.py:72 scripts/export_chat.py:76 scripts/extract_keys.py:24 scripts/extract_keys.py:25 scripts/extract_keys.py:24 scripts/extract_keys.py:25 scripts/extract_keys.py:28 scripts/extract_keys.py:635 scripts/extract_keys.py:19 scripts/extract_keys.py:431 scripts/extract_keys.py:319 scripts/extract_keys.py:283 scripts/extract_keys.py:441 scripts/extract_keys.py:339 scripts/list_contacts.py:14 scripts/list_contacts.py:15 scripts/list_contacts.py:95 scripts/list_contacts.py:14 scripts/list_contacts.py:15 scripts/list_contacts.py:95 scripts/list_contacts.py:68 scripts/list_contacts.py:100 scripts/search_sns.py:25 scripts/search_sns.py:26 scripts/search_sns.py:25 scripts/search_sns.py:26 scripts/search_sns.py:75 scripts/search_sns.py:83 scripts/vault_cli.py:29 scripts/vault_cli.py:29 scripts/vault_cli.py:94 scripts/wechat_digest.py:15 scripts/wechat_digest.py:16 scripts/wechat_digest.py:61 scripts/wechat_digest.py:15 scripts/wechat_digest.py:16
🔑 Переменные окружения (19)
scripts/decrypt_all_dbs.py:93 scripts/decrypt_all_dbs.py:95 scripts/export_chat.py:83 scripts/export_chat.py:84 scripts/extract_keys.py:334 scripts/extract_keys.py:336 scripts/list_contacts.py:31 scripts/list_contacts.py:33 scripts/search_sns.py:43 scripts/search_sns.py:45 scripts/vault_cli.py:105 scripts/vault_cli.py:110 scripts/vault_cli.py:115 scripts/vault_cli.py:117 scripts/wechat_digest.py:54 scripts/wechat_digest.py:56 scripts/wechat_digest.py:67 scripts/wechat_digest.py:295 scripts/wechat_digest.py:296
⚙️ Внешние команды (50)
scripts/extract_keys.py:218 scripts/extract_keys.py:256 scripts/extract_keys.py:436 scripts/wechat_digest.py:334 SKILL.md:9 SKILL.md:32 SKILL.md:33 SKILL.md:37 SKILL.md:39-52 SKILL.md:52-54 SKILL.md:54 SKILL.md:60-63 SKILL.md:63-65 SKILL.md:65-67 SKILL.md:67-68 SKILL.md:68-69 SKILL.md:69 SKILL.md:70-71 SKILL.md:71-73 SKILL.md:73-79 SKILL.md:79-81 SKILL.md:81-85 SKILL.md:85-87 SKILL.md:87-91 SKILL.md:91-93 SKILL.md:93-97 SKILL.md:97-99 SKILL.md:99-103 SKILL.md:103-105 SKILL.md:105-109 SKILL.md:109-111 SKILL.md:111-115 SKILL.md:115-117 SKILL.md:117-121 SKILL.md:121-123 SKILL.md:123-125 SKILL.md:125-133 SKILL.md:133-134 SKILL.md:134 SKILL.md:136-143 SKILL.md:143-144 SKILL.md:144-146 SKILL.md:146-152 SKILL.md:152-153 SKILL.md:153-159 SKILL.md:159 SKILL.md:164 SKILL.md:165-166 SKILL.md:166 SKILL.md:169-170
Обнаруженные паттерны
System reconnaissance×8
Аудитор:: codex Посмотреть историю аудитов →
Поделиться и цитировать этот отчет
Делитесь версионным отчетом об оценке, нейтральным значком, встраиваемой карточкой и цитатами. Skillstore публикует доказательства, не решая, безопасен ли этот Skill.
Копировать ссылку на отчёт
https://skillstore.io/skills/mcncarl-wechat-local-vault/audits/3?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportЗначок Markdown
[](https://skillstore.io/skills/mcncarl-wechat-local-vault?utm_source=security_passport_badge)Значок HTML
<a href="https://skillstore.io/skills/mcncarl-wechat-local-vault?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/mcncarl-wechat-local-vault/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Встраиваемая карточка
<iframe src="https://skillstore.io/embed/skills/mcncarl-wechat-local-vault.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Академические ссылки (APA · BibTeX · CFF)
Цитата APA
mcncarl. (2026). wechat-local-vault security audit report (audit version 3) [Author version unspecified]. Skillstore. https://skillstore.io/skills/mcncarl-wechat-local-vault/audits/3Цитата BibTeX
@techreport{mcncarl-mcncarl-wechat-local-vault-2026,
author = {mcncarl},
title = {wechat-local-vault security audit report (audit version 3)},
institution = {Skillstore},
year = {2026},
number = {3},
url = {https://skillstore.io/skills/mcncarl-wechat-local-vault/audits/3},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "wechat-local-vault security audit report (audit version 3)"
version: "unspecified"
type: report
authors:
- name: "mcncarl"
date-released: "2026-07-11"
url: "https://skillstore.io/skills/mcncarl-wechat-local-vault/audits/3"
identifiers:
- type: other
value: "skillstore:mcncarl-wechat-local-vault:audit:3"
description: "Skillstore immutable audit report identifier"
Оценка Skillstore
Почему такая оценка Достоверность доказательств: Средний 59
Архитектура
85
Сопровождаемость
87
Контент
65
Сообщество
83
Соответствие спецификации
Что вы можете построить
Просмотр личной переписки
Экспортируйте одну авторизованную беседу и проанализируйте ее хронологию, тональность, решения и задачи, требующие дальнейших действий.
Подготовка сводки по группе
Создайте ограниченный пакет исходных данных и обобщите темы, активность участников, решения и нерешенные вопросы.
Отслеживание взаимодействий с клиентами
Ищите в авторизованных чатах с клиентами обязательства, оставшиеся без ответа вопросы и недавнюю активность за заданный период.
Попробуйте эти промпты
Проверка состояния хранилища
Проверь состояние моего авторизованного локального хранилища WeChat. Сообщи о доступных базах данных, отсутствующих ключах, актуальности данных и расположении конфиденциальных выходных данных.
Экспорт одной беседы
Экспортируй мою переписку с [контакт или группа] за период с [дата начала] по [дата окончания]. Используй минимально необходимый объем данных и сохрани удобочитаемый отчет.
Создание сводки по группе
Создай пакет исходных данных для сводки по группе [группа] за период [диапазон дат]. Обобщи основные темы, решения, сведения об участниках и нерешенные вопросы, не раскрывая лишние сообщения.
Анализ риска отсутствия дальнейших действий
Выполни поиск в авторизованных чатах с [клиент] за последние [период]. Определи обязательства, оставшиеся без ответа вопросы, изменения тональности и рекомендуемые дальнейшие действия, указав подтверждающие даты.
Лучшие практики
- Перед доступом к любой учетной записи или переписке WeChat подтвердите право собственности и наличие разрешения.
- Перед полной расшифровкой или массовым экспортом ограничивайте область поиска конкретными контактами и диапазонами дат.
- Храните ключи, незашифрованные базы данных и отчеты в приватных локальных каталогах с ограничительными правами доступа.
Избегать
- Не просматривайте учетную запись, устройство или переписку другого человека без явного разрешения.
- Не размещайте незашифрованные базы данных или ключи многократного использования в общих папках, репозиториях или облачных хранилищах.
- Не запрашивайте полные архивы, если для ответа достаточно ограниченной беседы или диапазона дат.
Часто задаваемые вопросы
Какие версии WeChat поддерживаются?
Скрипты предназначены для структур WeChat Mac 4.x. Обновления приложения могут изменять схемы баз данных или механизм выработки ключей.
Передает ли навык данные по сети?
Сетевых запросов приложения обнаружено не было. При отсутствии необходимых пакетов установка зависимостей может обращаться к репозиториям пакетов Python.
Где хранятся расшифрованные базы данных?
По умолчанию хранилище находится в локальном каталоге Application Support. В конфигурации можно выбрать другой локальный путь.
Может ли навык распознавать содержимое изображений?
Нет. Навык может индексировать сообщения с изображениями, но для описания визуального содержимого в сводках требуются отдельные описания изображений.
Безопасно ли извлекать ключи?
Навык инструментирует подписанную копию WeChat и перехватывает криптографические материалы. Запускайте его только на авторизованном устройстве после ознакомления с предупреждениями о безопасности.
Можно ли обновлять только недавние данные?
Да. Инкрементальный режим пропускает неизмененные базы данных и может экспортировать выбранные беседы начиная с указанного времени.
Сведения для разработчиков
Автор
mcncarlЛицензия
MIT
Ревизия Skillstore
r1
Примечание о версии
Автор не указал версию.
Ссылка
c0271103e9d6ff62c5aa5b85e8fbc03aad6fc662
Актуальность поддержки
18.07.2026
Использование
8 загрузок · 1 просмотров
Структура файлов