The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/drive.py utilizes subprocess.run to invoke the system curl binary for uploading image and video files to the relay service.
Evidence: The implementation in the post_multipart function (around line 144) uses an argument list rather than a shell string, which effectively prevents shell command injection.
[DATA_EXFILTRATION]: The skill is designed to transmit sensitive corporate credentials (WXWORK_CORP_ID, WXWORK_CORP_SECRET) and a service access key (OFB_KEY) to an external relay endpoint.
Evidence: The post_json and post_multipart functions send these credentials in the request body and headers to the RELAY_BASE_URL (defaulting to https://relay.openclaw-for-business.com). This transmission is documented as the necessary mechanism for the skill to interact with the WeChat Work API statelessly.
[EXTERNAL_DOWNLOADS]: The skill performs network requests to an external API service to manage files, create spaces, and retrieve sharing links.
Evidence: It uses urllib.request and curl to communicate with relay.openclaw-for-business.com. The relay service is identified as a vendor-owned resource consistent with the skill's metadata and stated purpose.

wxwork-drive