baoyu-post-to-wechat

Pass

Audited by Gen Agent Trust Hub on Mar 25, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill employs system-level automation commands, including osascript on macOS, powershell on Windows, and xdotool/ydotool on Linux, to simulate physical paste keystrokes. This is a documented design choice required to insert content into the WeChat web editor, which typically blocks synthetic events.
  • [EXTERNAL_DOWNLOADS]: Setup and troubleshooting documentation includes a command to install the Bun runtime via curl | bash from the official bun.sh domain. This is provided as an optional step to satisfy the skill's execution requirements.
  • [EXTERNAL_DOWNLOADS]: The markdown conversion component dynamically fetches language highlighting grammars from a content delivery network (cdn-doocs.oss-cn-shenzhen.aliyuncs.com) during runtime to style code blocks in the published articles.
  • [COMMAND_EXECUTION]: The environment check utility (check-permissions.ts) programmatically generates and runs temporary Swift source files on macOS to verify that the local machine has the necessary image processing and clipboard capabilities.
  • [CREDENTIALS_UNSAFE]: WeChat AppID and AppSecret are managed using standard .env configuration files. The skill includes a guided setup flow that encourages users to store these secrets in local hidden directories rather than hardcoding them.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 25, 2026, 03:07 PM