wechat-2d-render
Warn
Audited by Gen Agent Trust Hub on Jul 24, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches source code and project assets from a public GitHub repository at
https://github.com/sxhzju/wechat-2d.git. This source is not a recognized trusted vendor or organization. - [REMOTE_CODE_EXECUTION]: After cloning, the skill executes
pnpm installandpnpm run remotion:render. This runs scripts and installs dependencies defined in the external repository, which allows arbitrary code execution from a third-party source on the host system. - [COMMAND_EXECUTION]: The script automates several system-level tasks using shell commands, including directory creation (
mkdir), repository management viagit, and enabling package managers throughcorepack enable pnpmto facilitate the rendering process.
Audit Metadata