wechat-post-publisher

No clear malware or unauthorized network exfiltration is present. The module is browser automation code, but it exposes intentional page-context JavaScript execution and contains an unsafe selector interpolation in clickElement, plus shell interpolation of the WSL profile path. Treat selector, expression, and environment-derived values as trusted-only inputs and escape or avoid shell interpolation where possible.

This is an image-resolution and download utility, with no clear evidence of malware. If image paths or URLs can be supplied by untrusted users, unrestricted HTTP requests and redirects can enable SSRF, and unrestricted local paths can expose filesystem resources; unbounded downloads can also consume disk space.

No direct, explicit malware behavior is evident in this module (no hardcoded secrets, no suspicious exfiltration endpoints, no persistence). However, it implements high-impact automation capabilities: extensive page-context JavaScript execution via ab(['eval', ...]) and a sensitive fallback that reads local files in the browser context using fetch(file://...) to upload images. The primary security risk is abuse potential if the external agent-browser binary or runtime environment is compromised, or if attacker control extends to the eval inputs or image paths. This should be run only with trusted dependencies and in a controlled environment.

This module is a dual-use cross-platform keystroke injection utility that performs a real paste (Cmd+V/Ctrl+V equivalents) to the active/frontmost application and explicitly aims to bypass synthetic paste-event detection. No network exfiltration or persistence is present in the provided code, but the behavior is inherently security-sensitive (UI input automation) and can be abused for clipboard-driven attacks. The highest concrete technical risk is on macOS: user-supplied --app is interpolated into dynamically constructed AppleScript executed via osascript without escaping/validation, creating an AppleScript-evaluation injection risk. Overall: elevated security risk; treat as high-impact automation code and restrict/validate inputs when used.