The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill explicitly instructs the agent to use dangerouslyDisableSandbox: true because the wx-cli tool and WeChat data directories (such as ~/.wx-cli/ and ~/Library/Containers/com.tencent.xinWeChat/) reside outside the default security sandbox.\n- [COMMAND_EXECUTION]: The skill relies on local command execution, including the wx binary for data fetching and standard shell utilities like jq, grep, and wc for processing large JSON payloads and performing audits.\n- [INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to instructions embedded in chat messages (Untrusted Data). It implements a mandatory evidence chain for mitigation: (1) Ingestion points: raw chat history via wx history, memory.md, and user profiles. (2) Boundary markers: The skill instructs the agent to ignore messages that command the bot to change behavior. (3) Capability inventory: Full file read/write access and command execution capabilities. (4) Sanitization: The references/group-memory.md file defines specific 'anti-injection' (防注入) rules to filter command-like messages from being recorded in the long-term memory.

baoyu-wechat-summary