youmind-wechat-article
Pass
Audited by Gen Agent Trust Hub on May 18, 2026
Risk Level: SAFE
Full Analysis
- [REMOTE_CODE_EXECUTION]: Automated scanner alerts identified a pattern in the README where
curloutput is piped to Python. Investigation confirmed this is a benign utility command used to parse a JSON response to find the user's public IP for IP whitelisting purposes, not an execution of remote code. - [DYNAMIC_EXECUTION]: Heuristic scans detected dynamic module loading and path construction. These are used for standard integration with the vendor's internal prompt libraries and system logging streams, which are typical for the skill's architecture and do not involve untrusted input.
- [COMMAND_EXECUTION]: The toolkit utilizes the
mmdc(Mermaid CLI) tool for diagram rendering. It handles diagram source code by writing to temporary files rather than direct shell argument interpolation, which mitigates typical command injection risks. - [DATA_EXFILTRATION]: All network operations are directed toward well-known and legitimate service endpoints (WeChat and YouMind APIs). This behavior is strictly aligned with the skill's primary purpose of article distribution and archiving.
- [CREDENTIALS_UNSAFE]: The skill manages authentication tokens and secrets via local configuration files. No hardcoded credentials or unsafe transmission patterns were detected during the analysis.
Audit Metadata