The Agent Skills Directory

REMOTE_CODE_EXECUTION (HIGH): The script scripts/md/utils/languages.ts dynamically imports JavaScript files from an external CDN (cdn-doocs.oss-cn-shenzhen.aliyuncs.com) using import(). This allows for the execution of arbitrary code from a non-trusted third-party source at runtime.
COMMAND_EXECUTION (HIGH): Multiple scripts utilize spawnSync to execute system commands.
scripts/md-to-wechat.ts executes npx -y bun which can download and run arbitrary packages.
scripts/paste-from-clipboard.ts executes osascript, powershell, xdotool, and ydotool to interact with the OS UI.
INDIRECT PROMPT INJECTION (HIGH): The skill processes untrusted Markdown content with high-privilege capabilities.
Ingestion points: scripts/md-to-wechat.ts (Markdown file input).
Boundary markers: Absent; the content is parsed and rendered directly.
Capability inventory: File writing (writeFile), network downloads (http.get), command execution (spawnSync), and OS keystroke simulation.
Sanitization: None detected; untrusted input is converted to HTML and processed by OS-level tools.
DATA_EXFILTRATION (MEDIUM): scripts/md/extensions/plantuml.ts sends diagram source code to https://www.plantuml.com/plantuml. An attacker could use this to exfiltrate sensitive data by embedding it within a PlantUML code block in a processed Markdown file.
EXTERNAL_DOWNLOADS (MEDIUM): scripts/md-to-wechat.ts contains a downloadFile function that fetches arbitrary remote images specified in the Markdown, which could be used for SSRF or to download malicious payloads.
DYNAMIC_EXECUTION (MEDIUM): scripts/md/extensions/infographic.ts uses dynamic imports for @antv/infographic, and scripts/md/extensions/plantuml.ts fetches remote SVG content and injects it into the DOM using .outerHTML without sanitization.

baoyu-post-to-wechat