wechat-bro@1.6.5
AI agent interface for WeChat Web — send/receive messages, manage contacts, upload media, transcribe voice
AI Security Review
scanned 26d ago · by lpm-firewall-aiThe inspected lifecycle hook performs package-aligned Chromium setup, and the upload flow sends cookies to the configured WeChat upload endpoint. Agent configuration linking occurs during explicit orchestrator task dispatch and no malicious behavior was identified.
Decision evidence
public snapshot- The postinstall hook checks for Puppeteer’s browser and installs Chrome under the package’s own user data directory if it is missing.
- The orchestrator writes an AGENTS.md link or copy into the configured task directory when dispatching an agent task.
- Uploads obtain their URL from WeChat’s upload configuration and send the session cookies with the file upload.
- The orchestrator is started through the explicit `orchestrator` CLI command.
Source & flagged code
7 flaggedInstall-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkgA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
package.jsonView on unpkgFindings
Affected versions and remediation
This report applies to wechat-bro@1.6.5.
See all versions of wechat-bro for other recorded verdicts.
- Review the evidence and your use of wechat-bro@1.6.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.