The Agent Skills Directory

Data Exposure & Exfiltration (HIGH): The script scripts/wechat-bridge.js implements a POST /api/send endpoint that accepts a path parameter.
Evidence: Inside the switch (type || 'text') block, the code executes const fileBox = FileBox.fromFile(path); await target.say(fileBox); when the type is 'image' or 'file'.
Risk: There is no validation, sanitization, or restriction on the path provided. An attacker with access to this API could specify sensitive file paths (e.g., /etc/passwd, ~/.ssh/id_rsa, or the skill's own .env file containing the PADLOCAL_TOKEN) and have the bot send those files to a WeChat recipient.
Unverifiable Dependencies (LOW): The skill requires several Node.js dependencies, including wechaty-puppet-padlocal.
Evidence: package.json lists these dependencies, and SKILL.md instructs the user to run npm install.
Risk: While standard for this type of integration, it introduces a reliance on third-party code and services (pad-local.com) for core functionality.
Indirect Prompt Injection (LOW): The skill processes untrusted user input from WeChat and forwards it to an AI gateway.
Ingestion points: Received WeChat messages are captured in handleMessage within scripts/wechat-bridge.js.
Boundary markers: None. The messages are forwarded as raw text.
Capability inventory: The skill possesses file-reading capabilities (FileBox) and is granted Bash, Read, and Write tools in its metadata.
Sanitization: None. Raw message content is passed directly to the OPENCLAW_GATEWAY_URL via axios.post.
Network Operations (LOW): The skill transmits message data, user IDs, and metadata to a user-defined external gateway.
Evidence: The forwardToOpenClaw function in scripts/wechat-bridge.js sends payloads to process.env.OPENCLAW_GATEWAY_URL.

wechat-channel