The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The script scripts/visualize.py executes external TypeScript code using the bun runtime via subprocess.run. The code is located in a vendored directory (vendor/baoyu-danger-gemini-web/scripts), which means the skill relies on code outside its primary instruction set.
[COMMAND_EXECUTION]: The skill invokes the obsidian CLI using subprocess.run to manipulate document metadata and trigger GUI actions. It also uses shutil.which to locate system binaries for execution.
[DATA_EXFILTRATION]: The skill accesses sensitive credentials from conductor/api_keys.json (including keys for Gemini, SiliconFlow, TinyPNG, and Tencent COS). It transmits article content and generated prompts to these external services, which is the intended functional behavior but constitutes a data flow to third-party providers.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes untrusted article content to generate the Storyboard.md file.
Ingestion points: Reads user-provided article drafts from input_file to design visual prompts.
Boundary markers: No explicit boundary markers or safety instructions are used to separate untrusted content from the generation logic.
Capability inventory: The skill possesses capabilities for network exfiltration (Tencent COS, AI APIs), subprocess execution (Bun, Obsidian), and local file modification (VisualPipeline.inject).
Sanitization: While filenames are sanitized, the prompts generated from the article content are passed as arguments to the bun execution script without comprehensive sanitization against malicious instructions.

wechat-director