The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/publish.py uses subprocess.run to execute scripts/render.py. This is implemented safely by passing a list of arguments and using the current Python executable (sys.executable), preventing shell injection vulnerabilities.
[CREDENTIALS_UNSAFE]: The skill manages WeChat API credentials (WECHAT_APP_ID, WECHAT_APP_SECRET) using a private YAML configuration file stored in the user's home directory (~/.config/soia-skills/...). This practice effectively separates sensitive secrets from the skill's logic and the repository, adhering to secure secret management standards.
[DATA_EXFILTRATION]: While the skill is designed to transmit article content to WeChat, it targets official API endpoints for the purpose of creating drafts. The implementation includes clear documentation and 'confirm-before-send' instructions, ensuring user control over data movement.

soia-pkm-publish