The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/video_download_transcribe.py supports executing an external Node.js helper script for decrypting WeChat videos. The path to this executable is determined at runtime via the ANINGNEO_WECHAT_DOWNLOADER environment variable or the --wechat-downloader command-line argument, which allows for the execution of arbitrary code from user-controlled paths.
[COMMAND_EXECUTION]: Several scripts, including scripts/tikhub_request.py and scripts/volc_auc.py, use subprocess.run to invoke the macOS security utility. This is used to query the system keychain for stored API keys and access tokens.
[DATA_EXFILTRATION]: The scripts/tikhub_request.py script implements a feature where query parameters or request bodies starting with the '@' character are interpreted as file paths. The contents of these files are read and included in network requests, which could be exploited to exfiltrate sensitive local files to the configured API endpoints.
[EXTERNAL_DOWNLOADS]: The skill downloads media and metadata from social media platforms through the TikHub API (api.tikhub.io) and sends audio data to Volcengine (openspeech.bytedance.com) for processing. These are external network dependencies required for the skill's primary functions.
[CREDENTIALS_UNSAFE]: The skill's setup instructions and configuration scripts facilitate saving sensitive TikHub API keys in a local plain-text file (scripts/.tikhub_api_key) to maintain authentication state across different agent sessions.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it processes unverified external data.
Ingestion points: Data is ingested from social media posts, comments, and AI-generated transcripts fetched via the TikHub API in scripts/video_download_transcribe.py.
Boundary markers: There are no explicit delimiters or instructions to the agent to isolate the analyzed social media content from its core logic.
Capability inventory: The skill has capabilities for network access, local file writing, and shell command execution.
Sanitization: While scripts include logic to redact tokens and secrets from metadata, the semantic content of the social media data is not sanitized, leaving the agent vulnerable to instructions embedded in public content.

aningneo-research