tuzi-post-to-wechat
Fail
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: HIGHCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides instructions to install the Bun runtime using a piped shell command (
curl | bash) from the official bun.sh domain. - [COMMAND_EXECUTION]: To handle WeChat's editor limitations, the skill executes system commands (using
osascripton macOS,xdotool/ydotoolon Linux, and PowerShell on Windows) to simulate paste keystrokes. - [DYNAMIC_EXECUTION]: The Markdown rendering engine dynamically imports JavaScript modules for syntax highlighting from a remote CDN (
cdn-doocs.oss-cn-shenzhen.aliyuncs.com) at runtime. - [EXTERNAL_DOWNLOADS]: The conversion logic downloads remote images referenced in user-provided Markdown files to local temporary storage and fetches diagram renders from PlantUML servers.
- [DATA_EXFILTRATION]: The skill reads WeChat API credentials (AppID and AppSecret) from local
.envfiles. While this is standard practice for secret management in this context, it involves the handling of sensitive authentication data. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted Markdown and HTML files provided by the user. It lacks explicit sanitization before rendering and publishing, creating an attack surface where malicious input could influence agent behavior during the multi-step publishing workflow.
Recommendations
- HIGH: Downloads and executes remote code from: https://bun.sh/install - DO NOT USE without thorough review
Audit Metadata