juya
Pass
Audited by Gen Agent Trust Hub on Jul 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The scripts
rss-to-html.pyandwx-to-html.pyuse thesubprocess.runfunction to open the generated HTML reports in the user's default web browser using system-native commands likeopenorxdg-open. - [COMMAND_EXECUTION]: The script
wx-to-html.pyexecutes a local shell script (bin/wfp.sh) from thewebfetch-plusdependency to perform web scraping of WeChat articles. - [EXTERNAL_DOWNLOADS]: The skill fetches data from specific external domains:
daily.juya.ukfor RSS feeds andmp.weixin.qq.comfor news article content. - [PROMPT_INJECTION]: As the skill ingests content from external web pages, it is theoretically susceptible to indirect prompt injection or cross-site scripting (XSS). To mitigate this, the skill implements a robust
WechatHTMLCleanerinscripts/juya_utils.pythat uses a whitelist-based HTML parser to strip out unsafe tags and attributes before rendering the content. - [COMMAND_EXECUTION]: The skill uses
importlib.utilto dynamically load and execute its own helper scriptrss-to-html.pyfrom a fixed relative path within the skill's own directory.
Audit Metadata