guizang-social-card-skill

This is a poster-rendering CLI with no evident intentional malware or direct data theft. HTML-controlled poster IDs are used unsafely in output paths, allowing path traversal to write screenshots outside the configured output directory; supplied HTML is also executed by Chromium and can initiate network requests. Severity is moderate and depends on rendering untrusted HTML and the process's filesystem permissions; no suspicious domains, credentials, or environment variables are present in this fragment.