baoyu-post-to-wechat
Pass
Audited by Gen Agent Trust Hub on Jun 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill makes extensive use of
spawn,spawnSync, andexecSyncto run external processes. This includes running its own sub-scripts vianpxandbun, as well as invoking system-level utilities for UI automation. - [COMMAND_EXECUTION]: To handle clipboard operations across different operating systems, the skill uses
osascripton macOS,powershell.exe(SendKeys) on Windows, andxdotool/ydotoolon Linux to simulate real keystrokes (e.g., Cmd+V/Ctrl+V), which helps in bypassing synthetic event detection on websites. - [EXTERNAL_DOWNLOADS]: The markdown rendering component dynamically fetches syntax highlighting language files from an external CDN (
cdn-doocs.oss-cn-shenzhen.aliyuncs.com) and interacts with the PlantUML server (www.plantuml.com) for diagram generation. Additionally, the skill can download images from remote URLs if they are referenced in the provided markdown articles. - [COMMAND_EXECUTION]: The skill automates browser interactions by launching Google Chrome with remote debugging enabled and sending commands via the Chrome DevTools Protocol (CDP), including script evaluation and DOM manipulation.
Audit Metadata