The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses spawn and execSync to launch Google Chrome with remote debugging enabled and to execute various CLI tools, including agent-browser, osascript, xdotool, ydotool, and powershell.exe, for browser automation and system interaction.
[DYNAMIC_EXECUTION]: In copy-to-clipboard.ts, the skill dynamically generates a Swift script on macOS and executes it using the swift command. It also constructs and runs PowerShell scripts on Windows to manage image and HTML data in the system clipboard. Additionally, infographic.ts uses dynamic imports to load the @antv/infographic library at runtime.
[PRIVILEGE_ESCALATION]: The skill employs osascript on macOS and xdotool/ydotool on Linux to simulate system-level keyboard events like Command+V, Control+V, Enter, and Backspace. These actions allow the skill to control the frontmost application and bypass browser-level automation detections, representing high-privilege operations on the host system.
[EXTERNAL_DOWNLOADS]: The rendering engine fetches Highlight.js language definitions from an external Aliyun CDN (cdn-doocs.oss-cn-shenzhen.aliyuncs.com) and diagram data from the PlantUML server. The skill also downloads images from arbitrary remote URLs found within user-provided Markdown files in md-to-wechat.ts.
[REMOTE_CODE_EXECUTION]: The skill utilizes npx -y bun to execute its internal scripts and potentially external packages. It also performs dynamic JavaScript imports from a remote CDN in languages.ts and loads libraries like mermaid at runtime based on the content being processed.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted Markdown content provided by the user, which serves as an ingestion point for instructions or data that could trigger the skill's network download and shell execution capabilities. Evidence: The markdownFile parameter in scripts/wechat-article.ts and the file download logic in scripts/md-to-wechat.ts. Capability Inventory: Network operations (downloading images/JS), file system writes, and shell command execution across multiple scripts.

baoyu-post-to-wechat