baoyu-post-to-wechat

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs the agent to prompt the user for WECHAT_APP_ID/WECHAT_APP_SECRET and write those secret values into a .env file (showing the secrets as user_input placeholders), which requires the LLM to handle and output secrets verbatim.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). These URLs are suspicious because the code dynamically imports remote JavaScript from a third‑party OSS CDN (cdn-doocs.oss-cn-shenzhen.aliyuncs.com) which can deliver executable JS, and the project recommends piping a remote installer (https://bun.sh/install) into bash — both are common vectors to deliver malware or untrusted code.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime workflow reads free text from the user-supplied markdown content that is parsed and rendered into HTML (Step 1/2/3 via scripts/md-to-wechat.ts → scripts/md/render.ts, and then inserted for publishing), so an outsider’s poison can be delivered by providing a malicious markdown file/string.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill dynamically imports remote JS language bundles at runtime from the CDN URL template https://cdn-doocs.oss-cn-shenzhen.aliyuncs.com/npm/highlightjs/${HLJS_VERSION}/es/languages/${language}.min.js, which will fetch and execute external code in the renderer (scripts/md/utils/languages.ts), so it is a runtime external dependency that can execute remote code.