baoyu-post-to-wechat
Pass
Audited by Gen Agent Trust Hub on Mar 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill extensively uses
child_processto launch Google Chrome and automate it using the Chrome DevTools Protocol (CDP). It also invokes platform-specific utilities likeosascript(macOS),xclip/wl-copy(Linux), andpowershell.exe(Windows) to handle complex clipboard operations for rich text and images. On macOS, the skill dynamically generates and executes temporary.swiftfiles to interface with theAppKitlibrary for enhanced clipboard management. - [EXTERNAL_DOWNLOADS]: During content processing, the skill downloads remote images found in Markdown files to a local temporary directory. Additionally, the Markdown renderer dynamically fetches syntax highlighting language modules from an Aliyun OSS CDN (
cdn-doocs.oss-cn-shenzhen.aliyuncs.com) using dynamicimport()calls. - [REMOTE_CODE_EXECUTION]: A diagnostic tool provided with the skill (
scripts/check-permissions.ts) contains a log message string that suggests the user runcurl -fsSL https://bun.sh/install | bashif the Bun runtime is missing. This is purely for user guidance and documentation; the command is not executed by the skill itself.
Audit Metadata