The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local system commands and internal scripts to perform its tasks. In scripts/account-verify.mjs, it uses security find-generic-password to safely retrieve API keys from the macOS Keychain. In scripts/preprocess-and-publish.mjs, it attempts to use sips (a standard macOS image processing tool) or sharp to compress images before upload. It also uses spawn to orchestrate sub-scripts like preprocess-and-publish.mjs from pipeline.mjs.
[EXTERNAL_DOWNLOADS]: The skill interacts with external services to fulfill its primary function. It communicates with the vendor API at doubaoya.com for rendering and publishing. Additionally, scripts/fetch-article.mjs allows fetching article content from mp.weixin.qq.com (WeChat) to assist in theme extraction. Both are well-known or vendor-specific services related to the skill's purpose.
[CREDENTIALS_UNSAFE]: The skill accesses API keys stored in ~/.doubaoya/key and ~/.doubaoya/env. While these are sensitive paths, the skill treats them as standard secret management locations and includes logic to ensure keys are not printed to logs or standard output. Use of system keychains further demonstrates a secure-by-design approach for a local tool.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-provided Markdown and HTML files. While this is an attack surface, the risk is mitigated by the skill's specific output format (WeChat-compatible HTML) and the absence of instructions that would trigger high-privilege agent actions based on the input content. processed data.

dby-publish