youmind-wechat-article

SUSPICIOUS. The core writing/publishing workflow is mostly aligned with the stated purpose and uses same-org YouMind endpoints, but the skill's footprint is broader than necessary because it mandates automatic remote publishing through a proxy service and includes transitive installation of a third-party skill. This looks more like a high-trust vendor workflow than outright malware, but the extra trust chain and automatic external actions raise meaningful risk.

No clear malicious behavior or malware is present. The code is a Markdown-to-HTML converter with expected filesystem and HTML-processing functionality. Security risks exist when inputs are untrusted: raw Markdown HTML is preserved, previewHtml performs unescaped template interpolation, custom theme values can enter HTML/CSS, and convertFile can read arbitrary readable paths if its argument is attacker-controlled. Apply HTML sanitization, validate or escape all template values and language identifiers, and restrict file paths to an allowed directory.

The code has a legitimate LaTeX-to-SVG and HTML-processing purpose and contains no evident malware. It does introduce an HTML injection/XSS risk in the conversion-error fallback because raw LaTeX is interpolated into an HTML string. The data-formula attribute also needs complete HTML attribute escaping. Callers should sanitize input/output and use a context-appropriate HTML sanitizer; the fallback should HTML-escape LaTeX before insertion.