The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill utilizes the playwright library to render an HTML template containing untrusted chat records into a PNG image. In scripts/generate_report.py, the jinja2 template engine is initialized without enabling the autoescape feature. This causes user-provided chat messages to be interpolated directly into the HTML without sanitization, allowing an attacker to include malicious HTML or JavaScript within a chat log. These scripts would be executed in the context of the Chromium browser instance used for rendering, which could facilitate unauthorized access to local files or data exfiltration from the execution environment.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user data from chat records through scripts/analyze_chat.py and subsequently incorporates it into AI prompts defined in references/ai_prompt.md. The instructions lack explicit boundary markers or directives to ignore malicious instructions embedded within the chat data, creating a vulnerability where the agent's behavior or output could be manipulated by the contents of the processed chat logs.
[OBFUSCATION]: The README.md documentation employs non-standard URL structures, including installation paths prefixed with a tilde (~) and a badge link containing a redundant second URL preceded by a percent sign (%). This unusual formatting is suspicious and could be intended to evade automated security scanners or mislead users about the destination of the provided links.
[EXTERNAL_DOWNLOADS]: The skill instructions guide the user to download and install software from a remote ZIP file hosted on a GitHub repository (leonense22) using the npx skills add command.

wechat-daily-report