The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/fetch_sph_ai.py uses subprocess.run to execute system commands for setting up scheduled tasks and opening generated HTML reports in the browser. While intended for functionality, arbitrary command execution via shell interpolation is a potential risk if inputs were not controlled.
[PERSISTENCE]: The skill includes functionality to install a daily automated report generation task. On macOS, it creates a LaunchAgent in ~/Library/LaunchAgents/com.qoder.wechat-channels-ai-feed.plist. On Linux/Unix, it attempts to modify the user's crontab. These mechanisms ensure the script runs daily at a specific time (16:00).
[CREDENTIALS_UNSAFE]: The skill requires a REDFOX_API_KEY. The documentation and script prompts explicitly instruct the user to append this secret to their shell configuration files (e.g., ~/.zshrc or ~/.bashrc) using commands like echo 'export REDFOX_API_KEY=ak_... >> ~/.zshrc. This practice of storing long-lived secrets in plain-text shell profiles is less secure than dedicated secret managers.
[EXTERNAL_DOWNLOADS]: The script fetches content data from an external API https://redfox.hk/story/api/parseWork/querySphAiMsgs. The images displayed in the generated HTML reports are loaded from external WeChat servers (coverUrl).
[DYNAMIC_EXECUTION]: The script generates an HTML report by populating a template (assets/report_template.html or a fallback string) with data fetched from the API. The resulting file is then saved locally and automatically opened by the system's browser using open or xdg-open.

wechat-channels-ai-feed