The Agent Skills Directory

[COMMAND_EXECUTION]: The tool executes the camoufox-cli binary and a local database update script update-metrics.sh using the Python subprocess.run function. The implementation correctly passes arguments as a list rather than a shell string, effectively mitigating shell injection risks.
[DYNAMIC_EXECUTION]: The skill utilizes the eval command of camoufox-cli to execute JavaScript within the headless browser context. This functionality is used for web scraping and data extraction from the WeChat Channels Creator Center. The JavaScript code is hardcoded in the Python scripts (_INNER_TEXT_JS, _LIST_PARSE_JS) and is restricted to parsing DOM content.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes data from external web pages (WeChat Channels Creator Center). To mitigate indirect injection risks where malicious content in video descriptions could influence the agent, the tool uses strict regular expression patterns within the browser-side JavaScript to validate and extract specific metrics (e.g., numeric values for plays, likes, and shares) before they are returned to the agent environment.
[DATA_EXPOSURE_EXFILTRATION]: The skill captures QR codes for WeChat login and saves them to /tmp/qr-wx-channel.png to be displayed to the user. This is a necessary functional component for authenticated access to the WeChat creator platform and follows standard practices for temporary file usage.

expert-wx-channel