Security checks across malware telemetry and agentic risk
This Markdown-to-WeChat formatter is coherent, but it can automatically install software and run browser-based rendering during normal conversion, so users should review it before installing.
Install only if you are comfortable with a formatter that may run npm/pip installs and use a headless browser. Prefer running npm install yourself after reviewing package.json/package-lock.json, then invoke conversion with --no-auto-install in an isolated project or sandbox, especially for untrusted Markdown files.
"""
try:
print(f'[INFO] 正在安装依赖: {package_name}...')
result = subprocess.run(
[sys.executable, '-m', 'pip', 'install', package_name],
capture_output=True,
text=True,65/65 vendors flagged this skill as clean.