baoyu-post-to-wechat

Warn

Audited by Gen Agent Trust Hub on Sep 9, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill performs runtime generation and execution of Swift source code on macOS systems within scripts/copy-to-clipboard.ts and scripts/check-permissions.ts. It writes these scripts to temporary files and executes them via the swift command to interact with the native NSPasteboard for rich text and image data processing.
  • [COMMAND_EXECUTION]: The skill makes extensive use of platform-specific CLI tools to automate browser interactions and network tunneling. This includes osascript (macOS) for UI automation, xdotool or ydotool (Linux) and powershell.exe (Windows) for keystroke simulation, and the ssh command to establish SOCKS5 proxies for the 'Remote API' publishing method.
  • [EXTERNAL_DOWNLOADS]: The script scripts/wechat-image-loader.ts is capable of fetching image assets from arbitrary remote HTTP/HTTPS URLs provided by the user or within file metadata.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests and renders external Markdown and HTML files provided as input. While the output is formatted for WeChat, the processing of untrusted content alongside the skill's broad system capabilities (such as network tunneling, UI control, and local file access) presents a potential indirect prompt injection surface.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Sep 9, 2026, 07:47 AM
Security Audit — agent-trust-hub — baoyu-post-to-wechat