The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains explicit instructions to bypass safety and content moderation guidelines. In Step 2.2, the agent is instructed to circumvent OpenAI's content policy by rephrasing prompts when they are blocked by safety filters ("内容审核安全规则... 避免触发 OpenAI 内容政策... 如果某张图被 moderation_blocked 拒绝，立即改写 prompt 描述行为而非技术名词").
[COMMAND_EXECUTION]: The skill autonomously executes multiple shell commands and local scripts. It uses npx and bun to run scripts located in /agent/wechat-agent-skills/skills/ for tasks like URL scraping, translation, and publishing. These operations occur without any manual confirmation from the user ("全程不等待用户确认").
[COMMAND_EXECUTION]: The skill performs automated package installation in the environment check section. It runs npm install jimp @jsquash/webp if the modules are not found, which could be used for dependency confusion or supply chain attacks if the package names are manipulated.
[DYNAMIC_EXECUTION]: The skill dynamically generates and writes configuration files (EXTEND.md) to the filesystem using shell redirection and heredocs in the "首次运行环境检查" (First Run Environment Check) section.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external websites (Hacker News, GitHub, and user-provided URLs) which can lead to indirect prompt injection vulnerabilities.
Ingestion points: Scraping external web content in Step 0.1 and Step 1.1 using baoyu-url-to-markdown.
Boundary markers: None. The skill does not use delimiters or instructions to ignore embedded commands in the scraped content.
Capability inventory: The skill has broad capabilities including file system write access, local script execution via npx, and network access to publish content to WeChat.
Sanitization: No sanitization or validation of the ingested external content is performed before it is used to write articles or generate image prompts.

wechat-publish-pipeline