wjs-tweeting-from-articles
Pass
Audited by Gen Agent Trust Hub on May 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on several bash scripts (
daily.sh,setup.sh,pick-next-article.sh,uninstall.sh) to manage the workflow, find articles, and interface with CLI tools likexurl,jq, and theclaudeagent. It also uses macOSlaunchctlto install a persistent background service at~/Library/LaunchAgents/com.jianshuo.wjs-tweeting-from-articles.plist. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and processes external data (
article.md) to generate public social media posts. - Ingestion points: Content from
article.md(located in~/code/wechat-publish/articles/) is read and passed as a prompt to the Claude CLI indaily.sh. - Boundary markers: None. The prompt provided to the agent does not use delimiters or instructions to ignore potential commands embedded within the article text.
- Capability inventory: The skill uses
xurlfor network POST requests to the Twitter API and invokes theclaudeCLI withReadandWritetool permissions. - Sanitization: The article content is not sanitized or validated before being included in the prompt, creating a risk that malicious text in an article could manipulate the agent's output or tool usage.
Audit Metadata