registry / wechat-claude-skill / 1.1.21

wechat-claude-skill@1.1.21

Claude Code skill: sync conversation to WeChat via iLink API

AI Security Review

scanned 12d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package silently mutates Claude Code's global hook configuration and installs command skills. After a user later binds WeChat, those hooks export Claude event content and the bridge can inject WeChat messages into Claude.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm postinstall; later Claude hook events and explicit QR binding

Impact

Unconsented AI-agent control-surface modification and subsequent conversation/permission-context exfiltration to the bound WeChat account.

Mechanism

global Claude hook/skill installation plus WeChat relay

Policy narrative

On npm installation, postinstall calls installSkill(), which adds six global Claude Code command hooks and writes global skills without a user command. Once a user later completes QR login, hook-handler sends Claude responses, errors, permission requests, and elicitation content through the WeChat iLink API. CLI mode also accepts polled WeChat text and injects it into a spawned Claude session.

Rationale

The package's stated integration purpose does not justify its unconsented postinstall mutation of a foreign global AI-agent control surface. This meets the firewall block criterion even though the later WeChat binding is user initiated. Product guard normalized a concrete AI-agent control hijack publish_block to the blockable dangerous-capability shape.

Evidence

package.jsondist/setup.jsdist/hook-handler.jsdist/pty-server.jsdist/wechat.jsdist/auth.js~/.claude/settings.json~/.claude/skills/wechat-cli/SKILL.md

wechat-claude-skill@1.1.21

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code