Is zhuyansen/wx-favorites-report safe?
https://github.com/zhuyansen/wx-favorites-report
This skill is a legitimate WeChat favorites data analysis tool that extracts, decrypts, and visualizes personal WeChat data using reverse engineering techniques. While it handles sensitive personal information and uses low-level system manipulation, no malicious behavior was detected and all operations align with the tool's stated purpose.
Category Scores
Findings (5)
HIGH Accesses Encrypted Personal WeChat Data -15 ▶
The skill extracts and processes encrypted WeChat favorite data, which contains personal messaging content, links, and usage patterns. While this is the skill's stated purpose, it represents significant privacy implications.
MEDIUM Uses Frida for Reverse Engineering -10 ▶
The skill includes JavaScript code for frida to hook WeChat's encryption functions and extract cryptographic keys. This involves low-level system manipulation but is legitimate for the tool's data extraction purpose.
MEDIUM Brief Canary File Access Detected -10 ▶
Monitoring detected access to honeypot files (.env, SSH keys, AWS credentials) during execution, though final integrity check confirmed no compromise occurred.
LOW Privacy and Policy Considerations -5 ▶
The tool processes personal messaging data and uses reverse engineering techniques that may violate WeChat's terms of service. Users should ensure proper consent and legal compliance.
INFO Complex Technical Documentation -5 ▶
The skill contains extensive technical documentation for reverse engineering processes, which increases complexity but shows no signs of prompt manipulation.