The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses spawn, spawnSync, and execSync to invoke a wide range of system utilities including ssh (for API tunneling), osascript (for macOS automation), powershell.exe (for Windows clipboard), swift (for macOS clipboard), and Linux clipboard tools (xclip, wl-copy).
[REMOTE_CODE_EXECUTION]: In scripts/copy-to-clipboard.ts, the skill dynamically generates Swift source code at runtime, writes it to a temporary file, and executes it using the swift interpreter to handle complex clipboard operations on macOS.
[DATA_EXFILTRATION]: scripts/wechat-article.ts contains functionality to capture screenshots of the login QR code and transmit them to an external Telegram bot API (api.telegram.org). While documented as a feature for remote login assistance, this allows local data to be sent to a third-party service.
[CREDENTIALS_UNSAFE]: The skill manages highly sensitive WeChat AppID and AppSecret credentials, along with SSH private keys for remote publishing. It provides a guided setup flow to store these in local .env files, which could be accessed by other malicious processes or skills on the same system.
[EXTERNAL_DOWNLOADS]: scripts/wechat-image-loader.ts enables the skill to download images from arbitrary remote URLs provided by the user or embedded in markdown files.

baoyu-post-to-wechat