The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes subprocess.run to execute the lark-cli tool for Feishu document management. These calls use argument lists rather than raw shell strings, effectively preventing shell injection vulnerabilities.
[EXTERNAL_DOWNLOADS]: The skill depends on standard packages and tools, including the installation of the Chromium browser via Playwright and interaction with the BrowserUse cloud API. All external references are consistent with the skill's stated functionality.
[DATA_EXPOSURE]: Sensitive configuration, such as the BrowserUse API key, is managed through environment variables or .env files. The project includes a .env.example file with no hardcoded credentials.
[REMOTE_CODE_EXECUTION]: The skill uses importlib to dynamically load local scripts within its own directory structure. This implementation is safe as the paths are statically defined and point to files included in the skill package.
[INDIRECT_PROMPT_INJECTION]: The skill ingests article content from external URLs. It implements sanitization by using BeautifulSoup to decompose potentially dangerous elements like <script>, <style>, and <iframe> before converting the content to Markdown.

wechat-article-browseruse