The Agent Skills Directory

[COMMAND_EXECUTION]: The install.sh script executes several high-privilege system commands using sudo, including apt update, apt install, and managing system services like postgresql. It also executes build commands (make, sudo make install) to install database extensions.
[COMMAND_EXECUTION]: In workflows/handle_message.js, the skill uses child_process.spawn to dynamically execute various Python scripts (answer_question.py, process_file.py, ocr_image.py, transcribe_voice.py) with user-provided data from WeChat messages passed as arguments.
[EXTERNAL_DOWNLOADS]: The installation script clones the pgvector repository directly from GitHub (https://github.com/pgvector/pgvector.git) to compile and install it, which is an external dependency managed outside of standard package registries.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted text, files, and images from WeChat users and passes them to Large Language Models for processing.
Ingestion points: Message text and file attachments received in bot.js via the onMessage event handler.
Boundary markers: None identified in the provided handleTextMessage logic to delimit untrusted input from system instructions.
Capability inventory: The skill can send outbound WeChat messages, notify external services via Telegram, and perform database read/write operations.
Sanitization: There is no evidence of content filtering or escaping for user-provided data before it is sent to the processing scripts.

wecom-automation