registry / AI-agent control-surface risk / wechat-claude-skill
wechat-claude-skill
Claude Code skill: sync conversation to WeChat via iLink API
This report shows the evidence for wechat-claude-skill@1.1.21, the only known version.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe package's stated integration purpose does not justify its unconsented postinstall mutation of a foreign global AI-agent control surface. This meets the firewall block criterion even though the later WeChat binding is user initiated. Product guard normalized a concrete AI-agent control hijack publish_block to the blockable dangerous-capability shape.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm postinstall; later Claude hook events and explicit QR binding
Impact
Unconsented AI-agent control-surface modification and subsequent conversation/permission-context exfiltration to the bound WeChat account.
Mechanism
global Claude hook/skill installation plus WeChat relay
Policy narrative
On npm installation, postinstall calls installSkill(), which adds six global Claude Code command hooks and writes global skills without a user command. Once a user later completes QR login, hook-handler sends Claude responses, errors, permission requests, and elicitation content through the WeChat iLink API. CLI mode also accepts polled WeChat text and injects it into a spawned Claude session.
AI rationale
The package's stated integration purpose does not justify its unconsented postinstall mutation of a foreign global AI-agent control surface. This meets the firewall block criterion even though the later WeChat binding is user initiated. Product guard normalized a concrete AI-agent control hijack publish_block to the blockable dangerous-capability shape.
Evidence
package.jsondist/setup.jsdist/hook-handler.jsdist/pty-server.jsdist/wechat.jsdist/auth.js~/.claude/settings.json~/.claude/skills/wechat-cli/SKILL.md~/.claude/skills/wechat-vscode/SKILL.md~/.claude/skills/unwechat/SKILL.md~/.wechat-claude-skill/account.json
Network endpoints1
ilinkai.weixin.qq.com
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 99.0% confidence with low false-positive risk.
Evidence for policy risk
- package.json postinstall runs `node dist/setup.js install` automatically.
- dist/setup.js writes global ~/.claude/settings.json hooks during install.
- dist/setup.js drops three global Claude skills under ~/.claude/skills/.
- dist/hook-handler.js forwards Claude responses, errors, permission prompts, and elicitation content to WeChat.
- dist/pty-server.js injects received WeChat messages into a spawned `claude` PTY.
- dist/wechat.js sends data through the iLink API using the QR-login token.
Evidence against
- QR login and token creation require an explicit later user scan.
- Network use is aligned with the advertised WeChat bridge functionality.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
4 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node dist/setup.js install
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node dist/setup.js install
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/setup.jsView file
5* Usage (after npm install -g):
L6: * wechat-claude-skill install Install skill + hook to global (~/.claude/)
L7: * wechat-claude-skill uninstall Remove skill + hook from global
...
L10: */
L11: import { existsSync, mkdirSync, writeFileSync, unlinkSync, readFileSync, rmdirSync } from 'node:fs';
L12: import { join } from 'node:path';
...
L22: // Global skill directory for Claude Code
L23: const GLOBAL_SKILL_DIR = join(homedir(), '.claude', 'skills');
L24: function saveState(state) {
L25: mkdirSync(BRIDGE_DIR, { recursive: true });
L26: writeFileSync(STATE_FILE, JSON.stringify(state, null, 2) + '\n');
L27: }
Critical
Ai Agent Control Hijack
Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
dist/setup.jsView on unpkg · L5347const bridgeUrl = `file:///${bridgePath.replace(/\\/g, '/')}`;
L348: await import(bridgeUrl);
L349: }
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/setup.jsView on unpkg · L347Findings
1 Critical1 High5 Medium5 Low
CriticalAi Agent Control Hijackdist/setup.js
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/setup.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to wechat-claude-skill@1.1.21.
The versions list below shows the verdict for each recorded version.
- Avoid installing wechat-claude-skill@1.1.21. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.