soia-pkm-clip-wechat-article
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted data from external WeChat URLs, which could potentially contain malicious instructions targeting the AI agent.
- Ingestion points: The
scripts/archive_wechat.pyscript fetches HTML content from externalmp.weixin.qq.comURLs provided as input. - Boundary markers: The extracted article content is wrapped in Markdown headers (
## 原文) and YAML frontmatter delimiters, though it lacks an explicit warning for the agent to ignore instructions within the clipped text. - Capability inventory: The skill has the capability to write files to the local filesystem (Obsidian vault) via the
atomic_write_textfunction. - Sanitization: The script uses a custom
HTMLParserto extract specific article components while ignoringscriptandstyletags. It also performs YAML escaping on metadata fields and uses strict path resolution to ensure files are only written within the designated vault. - [EXTERNAL_DOWNLOADS]: The
SKILL.mdfile suggests installation vianpxand theclaude plugin marketplaceusing packages associated with the vendor (soia-team). These references are consistent with the skill's stated provenance and installation workflow.
Audit Metadata