The Agent Skills Directory

[COMMAND_EXECUTION]: The script uses os.system() to open the output folder after conversion in scripts/yuque_lakebook_export/lake_setup.py. The output_path is concatenated directly into shell commands like open or explorer without sanitization. If the output path (derived from user input or filenames in the input file) contains shell metacharacters, it could lead to arbitrary command execution on the host system.
[REMOTE_CODE_EXECUTION]: In scripts/yuque_lakebook_export/lake_setup.py, the load_meta_json function uses yaml.load(book_yml, yaml.Loader) to parse Table of Contents data from the input files. Using yaml.Loader instead of yaml.SafeLoader is insecure as it allows the instantiation of arbitrary Python objects, which a malicious .lakebook file could use to execute code during the conversion process.
[EXTERNAL_DOWNLOADS]: The skill uses the requests library in scripts/yuque_lakebook_export/lake_handle.py to download images and attachments from remote URLs extracted from the processed documents. This functionality is part of the skill's primary purpose but depends on the integrity of the input files.

yuque-lakebook-export