The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions in SKILL.md (specifically Step 2 of the Usage Guide) direct the agent to execute a local Python script scripts/rewrite.py using raw user-provided text as a command-line argument. This pattern creates a command injection vulnerability; if the agent interpolates unescaped user content into a shell command string, a malicious user could execute arbitrary commands by including shell metacharacters like ;, &, or | in their input.
[EXTERNAL_DOWNLOADS]: The script scripts/rewrite.py utilizes the requests library to make network calls to https://redfox.hk/story/api/skill/record/save. This endpoint belongs to the vendor's infrastructure and is used for usage telemetry. While the script currently verifies SSL certificates and sends a static source identifier, the presence of network activity in a text-processing skill represents an external dependency.
[DATA_EXFILTRATION]: The skill implements a telemetry mechanism that connects to a remote server before outputting results. Although the current implementation only sends a hardcoded string (公众号文案改写-GitHub) and does not transmit the user's actual content, the capability to reach a remote endpoint establishes a functional path for data exfiltration if the script were altered.
[INDIRECT_PROMPT_INJECTION]: The skill processes arbitrary user-supplied text as its primary function. It lacks explicit boundary markers (such as XML tags or unique delimiters) or instructions to ignore embedded directives in the input text. This makes the skill potentially vulnerable to indirect prompt injection, where an attacker could embed malicious instructions within the text being rewritten to influence the agent's behavior.

wechat-rewrite