lieflat-xhs-longform
Warn
Audited by Gen Agent Trust Hub on Jul 25, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides several Node.js scripts (capture-xhs-card.mjs, capture-xhs-carousel.mjs, capture-template-previews.mjs) that spawn browser processes and execute shell commands to capture screenshots.
- [REMOTE_CODE_EXECUTION]: The scripts/capture-template-previews.mjs script utilizes the Chrome DevTools Protocol's Runtime.evaluate method to execute arbitrary JavaScript within the context of a headless browser.
- [COMMAND_EXECUTION]: Scripts such as capture-xhs-card.mjs and capture-xhs-carousel.mjs use dynamic import() to load the Playwright library. The module name is determined by user-supplied command-line arguments or the PLAYWRIGHT_MODULE environment variable, which represents dynamic loading from a computed path.
- [EXTERNAL_DOWNLOADS]: The assets/templates/xhs-sunrise/zh.html file references external assets (fonts) from Google's official font service (fonts.googleapis.com). This is documented as a standard practice for web-based design templates and targets a well-known service.
- [DATA_EXFILTRATION]: The scripts that take a --url argument (capture-xhs-card.mjs, capture-xhs-carousel.mjs, capture-screenshots.mjs) could potentially be directed to internal or sensitive network resources, posing a Server-Side Request Forgery (SSRF) risk if the input URL is not validated.
- [PROMPT_INJECTION]: The skill processes user-supplied article content that is interpolated into HTML templates (Category 8). Ingestion points: User-provided text replaced in templates via the agent workflow. Boundary markers: Absent in templates to prevent instruction injection from content. Capability inventory: Subprocess spawning and file writing in scripts/*.mjs. Sanitization: No explicit HTML sanitization or filtering of external content was found in the provided scripts.
Audit Metadata