baoyu-post-to-wechat
Pass
Audited by Gen Agent Trust Hub on Mar 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill employs system-level automation commands, including
osascripton macOS,powershellon Windows, andxdotool/ydotoolon Linux, to simulate physical paste keystrokes. This is a documented design choice required to insert content into the WeChat web editor, which typically blocks synthetic events. - [EXTERNAL_DOWNLOADS]: Setup and troubleshooting documentation includes a command to install the Bun runtime via
curl | bashfrom the officialbun.shdomain. This is provided as an optional step to satisfy the skill's execution requirements. - [EXTERNAL_DOWNLOADS]: The markdown conversion component dynamically fetches language highlighting grammars from a content delivery network (
cdn-doocs.oss-cn-shenzhen.aliyuncs.com) during runtime to style code blocks in the published articles. - [COMMAND_EXECUTION]: The environment check utility (
check-permissions.ts) programmatically generates and runs temporary Swift source files on macOS to verify that the local machine has the necessary image processing and clipboard capabilities. - [CREDENTIALS_UNSAFE]: WeChat AppID and AppSecret are managed using standard
.envconfiguration files. The skill includes a guided setup flow that encourages users to store these secrets in local hidden directories rather than hardcoding them.
Audit Metadata