The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The README.md file promotes an unsafe installation pattern by instructing users to run a PowerShell command (irm is.gd/rpb65M | iex) that downloads and executes code from a link shortener, posing a major risk of arbitrary code execution.
[DATA_EXFILTRATION]: The skill performs sensitive local data access to support its synchronization and voice generation features:
scripts/sync_jy_assets.py scrapes the user's %LOCALAPPDATA% directory to find and read JianYing's internal SQLite databases (rp.db) to synchronize asset metadata.
scripts/universal_tts.py harvests authentication-related parameters such as device_id and iid by searching through the application's local log files in the user profile.
[COMMAND_EXECUTION]: Several components execute arbitrary system commands via the subprocess module:
scripts/utils/media_normalizer.py and tools/recording/recorder.py invoke ffmpeg for video conversion and screen recording operations.
scripts/api_validator.py and scripts/sync_jy_assets.py execute ffprobe to determine media attributes and durations.
examples/robust_auto_export.py programmatically identifies and launches the JianYing application executable using paths found in the Windows Registry.
[EXTERNAL_DOWNLOADS]: The skill handles external data and software downloads with insufficient security controls:
scripts/cloud_manager.py downloads media assets from remote URLs discovered in logs or databases. While it implements protection for private IP addresses, the download sources themselves are unverified.
README.md provides an external download link for a specific version of the JianYing application executable via a third-party file-sharing service (pan.quark.cn).
scripts/universal_tts.py includes logic to explicitly disable TLS certificate verification (ssl.CERT_NONE) during network operations if an environment variable is set, increasing susceptibility to man-in-the-middle attacks.

jianying-editor