soia-pkm-library
Pass
Audited by Gen Agent Trust Hub on Jul 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the official WeChat Reading dependency from Tencent's public repository via
npx skills add Tencent/WeChatReading. - [COMMAND_EXECUTION]: Executes multiple local Python scripts to automate file management within the Obsidian vault, including creating reading records and generating summary Markdown files.
- [DATA_EXFILTRATION]: Communicates with the official WeChat Reading API gateway at
https://i.weread.qq.com/api/agent/gatewayto retrieve user reading data. This is restricted to the intended functionality of the skill. - [CREDENTIALS_UNSAFE]: Provides clear instructions for secure management of the
WEREAD_API_KEY. It directs users to store the token in a private configuration file outside the vault and repository, which aligns with security best practices.
Audit Metadata