The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses execFile and spawn to interact with camoufox-cli for browser automation. It also executes a local background script (wx_mp_keepalive.mjs) to maintain the browser session during the QR-code login process.
[EXTERNAL_DOWNLOADS]: The script download_images.ts fetches images from WeChat CDN domains. It implements several security and stability features, including:
Concurrency limits (default 4).
Maximum file size limits (5MB per image).
Total download size limits (100MB).
Automatic retries and timeouts.
[DATA_EXPOSURE]: The skill manages sensitive session data, including cookies and authentication tokens, which are stored in the user's home directory (~/.openclaw/logins/wx_mp.json). This behavior is documented and essential for the skill's persistent login functionality.
[PROMPT_INJECTION]: The skill processes untrusted content from the web (WeChat articles). It attempts to mitigate indirect injection risks by sanitizing the HTML, removing script and style tags, and converting the content to Markdown before presenting it to the agent.

wx-mp-hunter