The Agent Skills Directory

Data Exposure & Path Traversal (MEDIUM): The file convert.js contains hardcoded absolute paths to a specific user's home directory (/Users/canghe/).
Evidence: fs.readFileSync('/Users/canghe/.claude/projects/...') and fs.writeFileSync('/Users/canghe/Downloads/...').
Impact: This behavior is unsafe for a shared skill as it targets specific local file structures and could be modified to access sensitive configuration files if the directory structure matches the target system.
Indirect Prompt Injection (LOW): The skill is designed to parse and extract content from external WeChat Official Account articles (mp.weixin.qq.com).
Ingestion points: Third-party HTML content fetched via request-promise (as seen in README.md descriptions).
Boundary markers: None detected in the provided code to distinguish between article content and agent instructions.
Capability inventory: The skill uses cheerio for parsing and likely request-promise for network fetches (though scripts/extract.js was not provided, the dependencies and descriptions confirm this).
Sanitization: No explicit sanitization or instruction-filtering logic is present in the provided snippets.
Unverifiable Logic (MEDIUM): The core logic file scripts/extract.js referenced in SKILL.md and README.md is missing from the provided source files. This prevents a complete safety verification of the primary functional component.

wechat-article-extractor