wechat-theme-extractor
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external WeChat articles and processes it using the AI agent without clear boundary markers or instructions to ignore embedded commands.
- Ingestion points: The
scripts/extract.pyscript fetches article HTML and saves it to.extracted_content.htmlfor AI analysis. - Boundary markers: There are no explicit delimiters or instructions in
SKILL.mdto treat the article content as data only and ignore any embedded natural language instructions. - Capability inventory: The agent has the ability to write to local files (
markdown-to-wechat.html) and execute shell commands via the extraction script. - Sanitization: The skill lacks sanitization or validation of the extracted HTML content before the AI processes it.
- [COMMAND_EXECUTION]: The skill relies on executing a local Python script that invokes system commands.
- Evidence:
scripts/extract.pyusessubprocess.runto execute thecurlcommand with user-provided URLs. While implemented using a list of arguments to mitigate shell injection, it still provides a mechanism for network access and local process execution controlled by agent instructions.
Audit Metadata