The Agent Skills Directory

[DYNAMIC_EXECUTION]: The generated HTML report (produced by scripts/generate_weread_report.py) contains a JavaScript function named reviveFunctions that uses new Function() to dynamically evaluate and execute strings that start with function(. This mechanism is designed to allow the JSON-serialized chart configuration to include executable ECharts formatters for labels and tooltips.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external WeChat Reading API endpoints (such as /readdata/detail, /shelf/sync, and /user/notebooks), including book titles, author names, and user-generated notes. This data is incorporated into the chart configuration object within the generated HTML. Because reviveFunctions recursively iterates through and evaluates all strings in this object, a malicious value returned by the API (e.g., a book title or note starting with function( followed by malicious JavaScript code) could lead to arbitrary code execution in the context of the user's browser when the report is opened.
Ingestion points: Data is fetched from multiple WeRead API endpoints in scripts/generate_weread_report.py and aggregated into the report.
Boundary markers: The script lacks specific validation or sanitization to ensure that data values do not trigger the reviveFunctions execution logic.
Capability inventory: Arbitrary JavaScript execution in the browser via new Function().
Sanitization: While the script uses escape_html for textual elements in the HTML body, the chart data is serialized using json.dumps and then processed by the unsafe reviveFunctions logic.
[EXTERNAL_DOWNLOADS]: The generated HTML report fetches the ECharts library and WordCloud plugin from cdn.jsdelivr.net. These are official, well-known services for hosting open-source frontend libraries and are considered safe sources.
[COMMAND_EXECUTION]: The skill instructs the agent to execute a Python script (scripts/generate_weread_report.py) to fetch data and generate reports. This is the primary intended function of the skill.

yao-weread-skill