Skills
skills/yangsonhung/awesome-agent-skills/yuque-lakebook-export-cn/Gen Agent Trust Hub

yuque-lakebook-export-cn

Fail

Audited by Gen Agent Trust Hub on Apr 9, 2026

Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The script scripts/yuque_lakebook_export/lake_setup.py utilizes yaml.load() with the unsafe yaml.Loader to parse the table of contents (tocYml) extracted from .lakebook files. This configuration is vulnerable to arbitrary code execution if a user processes a maliciously crafted file.
  • [COMMAND_EXECUTION]: In scripts/yuque_lakebook_export/lake_setup.py, the convert_to_md function uses os.system() to automatically open the output directory upon completion. The path is concatenated into shell commands (e.g., explorer, open) without adequate sanitization of shell metacharacters. If a .lakebook filename or output path contains characters like & or ;, it can lead to arbitrary shell command execution.
  • [EXTERNAL_DOWNLOADS]: The skill performs automated network requests using the requests library in scripts/yuque_lakebook_export/lake_handle.py to download images and attachments from remote URLs found within the source documents.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Apr 9, 2026, 04:12 PM