The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The chrome-automation skill and its scripts explicitly use powershell -ExecutionPolicy Bypass to run installation and configuration logic, bypassing system-level security restrictions intended to prevent the execution of untrusted scripts.
[DATA_EXFILTRATION]: Publishing workflows in wechat-hotspot-publisher and wechatsync-publisher are configured to send article content (which may contain sensitive draft information) to an unverified external IP address (39.108.254.228) acting as a "custom API" instead of using official, authenticated platform endpoints.
[COMMAND_EXECUTION]: The chrome-automation installation scripts (auto-install-mac.sh and auto-install-windows.ps1) are designed to perform silent, non-interactive installations of multiple system dependencies, including Node.js, pnpm, and Playwright. They also download the Rust toolchain and trigger local compilation of native binaries without requiring user confirmation.
[PERSISTENCE]: The moltbook skill implements a recurring "heartbeat" mechanism. It instructs the agent to periodically (every 4+ hours) fetch content from an external URL (https://www.moltbook.com/heartbeat.md) and "follow it," which establishes a channel for external control over the agent's behavior.
[EXTERNAL_DOWNLOADS]: Multiple components download executable scripts and metadata from unverified external domains. For example, moltbook/SKILL.md uses curl to fetch and overwrite local skill files, and antinet-agentteams components fetch binary data from local endpoints that are then processed by sub-processes.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits a significant attack surface for indirect injection:
Ingestion points: baoyu-url-to-markdown (scripts/main.ts) and intelligent-content-system (SKILL.md) fetch and parse content from arbitrary user-provided URLs.
Boundary markers: Absent; fetched content is interpolated directly into processing steps and prompts without clear delimiters or instructions to ignore embedded commands.
Capability inventory: The system possesses high-impact capabilities including file system writes, network operations, and automated browser control.
Sanitization: Absent; the system relies on best-effort cleaning of HTML to Markdown without strict structural validation of the untrusted input.

xiaoyue-companion