技能 wonda-cli

📦

wonda-cli

Name: wonda-cli
Author: degausai

內容修訂 r2 嚴重 ⚙️ 外部命令🌐 網路存取📁 檔案系統存取🔑 環境變數

使用 Wonda CLI 建立並自動化媒體內容

透過多種工具建立及發佈媒體內容需要投入時間並進行協調。此技能提供 Wonda CLI 工作流程指引，涵蓋生成、編輯、研究、發佈及自動化。

支援: Claude Codex Code(CC)

⚠️ 38 差

Maintain this Skill? Claim it ⚠️ 38 差

請勿自動安裝此 Skill。

權威政策要求在執行任何安裝操作前由操作人員審查。

使用我的智慧代理安裝

將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。

智能體請求

Review the Skillstore skill "wonda-cli" from https://skillstore.io/skills/degausai-wonda-cli.md and its manifest at https://skillstore.io/api/skills/degausai-wonda-cli/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。

Agent 可讀資源

當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。

Markdown 詳情 GET /skills/degausai-wonda-cli.md 已簽名 manifest GET /api/skills/degausai-wonda-cli/manifest 已簽名 lockfile GET /api/skills/degausai-wonda-cli/lockfile

測試它

正在使用「wonda-cli」。建立附有字幕的直式產品預告片。

預期結果:

一份 9:16 預告片計畫，包含所選模型、提示詞、預估成本、字幕樣式、本機後製步驟及核准檢查點。

正在使用「wonda-cli」。研究近期關於 AI 影片工具的討論。

預期結果:

所選平台上反覆出現之主題的摘要。
公開範例清單，包含來源平台及作者。
不涉及自動互動的建議內容切入角度。

正在使用「wonda-cli」。將一段長篇訪談製作成三段短片。

預期結果:

三組建議的剪輯範圍，包含開場亮點、講者背景資訊、字幕語言、畫面重構方式及最終匯出位置。

安全審計

嚴重

v6 • 2026/7/23 開啟版本化報告

Most presented static matches are false positives caused by Markdown code spans, example URLs, and documented local paths. Confirmed findings cover executable credential workflows and proxy-based anti-abuse evasion; semantic review also found moderation bypass, default cookie export, mutable remote instructions, unpinned installation, and credential exposure. The scanner capped review at 400 of 654 matches, so 254 lower-priority matches still require manual review before publication. Static review was capped at 400/654 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.

已掃描檔案

1,944

分析行數

複核項目

已忽略的誤報

已確認的安全問題 (8)

嚴重

multiple:1

[HEURISTIC] DANGEROUS COMBINATION: Code execution + Network + Credential access

This combination is common in credential stealers and RATs

The skill directs agents to install and execute an external CLI, retrieve decrypted credentials, and transmit browser cookies. This confirms the dangerous capability combination, although the behavior is disclosed rather than obfuscated.

嚴重

SKILL.md:849

Provider Moderation Bypass for Real-Person Cloning

The guide recommends switching to Kling when another provider blocks a real-person reference, specifically because the raw face audio avoids a moderation classifier. This enables impersonation and non-consensual likeness or voice cloning.

The text explicitly names the blocked real-person condition, the alternate provider, and avoidance of the moderation classifier.

高

multiple:1

[HEURISTIC] SUSPICIOUS COMBINATION: Filesystem + Credentials + Network

This combination could indicate credential harvesting and exfiltration

The skill stores platform cookies on disk and states that synchronized cookie JSON is automatically pushed to the Wonda backend. Filesystem, credential, and network capabilities are therefore combined in a security-sensitive workflow.

高

SKILL.md:253-257 SKILL.md:290 SKILL.md:1689-1692

Automatic Cloud Upload of Browser Session Cookies

Cookie cloud backup is enabled by default and pushes synchronized platform cookie JSON to Wonda. The document states the wire payload is plaintext and server storage can be plaintext when its encryption key is absent.

The default, transfer destination, payload format, and conditional at-rest encryption are all explicitly documented.

高

SKILL.md:213-224 SKILL.md:1504-1506 SKILL.md:1626-1636 SKILL.md:1665

Platform Anti-Abuse Evasion and Synthetic Account Automation

The skill uses an antidetect browser, throwaway email, residential proxies, human-like motion, and varied messages to create accounts and avoid detection. It also automates engagement and outreach.

The guide repeatedly states anti-fingerprinting and shadowban-avoidance goals and provides complete account-creation and engagement workflows.

高

SKILL.md:418-426 SKILL.md:486-495

Mutable Remote Instructions Executed Without Pinning

The guide requires agents to pull account-editable skills live from Wonda and execute each step. It provides no content hash, signature verification, approval boundary, or prompt-injection review before execution.

Remote mutability and direct execution are explicit, while no integrity or trust-control step is documented in the reviewed skill.

高

SKILL.md:10-20

Unpinned Global Installation of Executable Packages

The setup directs agents to install the latest npm package globally or trust a Homebrew tap without a version, checksum, or signature verification step. A compromised upstream release would gain local execution.

Both installation commands are explicit and unpinned, and neither path includes an integrity verification step.

高

SKILL.md:160-185 SKILL.md:1491-1506 SKILL.md:1616-1626

Credential Exposure Through Agent Output and Arguments

The guide permits agents to retrieve decrypted passwords and pass passwords in command arguments. Account-creation flows also print passwords in success output, exposing secrets to process listings, shell history, transcripts, or logs.

The reviewed commands and prose explicitly describe decrypted retrieval, password arguments, and password-bearing success output.

能力複核項目 (2)

這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。

高

SKILL.md:1506

SOCKS proxy

**LinkedIn account creation:** `wonda linkedin signup` provisions a brand-new LinkedIn account: it m

This section recommends a mobile or residential SOCKS proxy when creating a new social account to avoid platform shadowbans. The proxy is explicitly used for anti-abuse evasion.

高

SKILL.md:1626

SOCKS proxy

`wonda reddit signup` provisions a brand-new Reddit account: it mints a throwaway mailbox (or uses `

This section recommends a mobile or residential SOCKS proxy when creating a new social account to avoid platform shadowbans. The proxy is explicitly used for anti-abuse evasion.

風險因素

⚙️ 外部命令 (50)

🌐 網路存取 (32)

📁 檔案系統存取 (49)

🔑 環境變數 (4)

SKILL.md:24 SKILL.md:35 SKILL.md:290 SKILL.md:1939

偵測到的模式

[HEURISTIC] DANGEROUS COMBINATION: Code execution + Network + Credential access

審計單位: codex 檢視審計紀錄 →

分享與引用此報告

分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。

開啟版本化報告

複製報告連結

https://skillstore.io/skills/degausai-wonda-cli/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/degausai-wonda-cli/security.svg)](https://skillstore.io/skills/degausai-wonda-cli?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/degausai-wonda-cli?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/degausai-wonda-cli/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/degausai-wonda-cli.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

學術引用 (APA · BibTeX · CFF)

APA 引用

degausai. (2026). wonda-cli security audit report (audit version 6) [Author version unspecified]. Skillstore. https://skillstore.io/skills/degausai-wonda-cli/audits/6

BibTeX 引用

@techreport{degausai-degausai-wonda-cli-2026,
  author = {degausai},
  title = {wonda-cli security audit report (audit version 6)},
  institution = {Skillstore},
  year = {2026},
  number = {6},
  url = {https://skillstore.io/skills/degausai-wonda-cli/audits/6},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "wonda-cli security audit report (audit version 6)"
version: "unspecified"
type: report
authors:
  - name: "degausai"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/degausai-wonda-cli/audits/6"
identifiers:
  - type: other
    value: "skillstore:degausai-wonda-cli:audit:6"
    description: "Skillstore immutable audit report identifier"

Skillstore 評分

評分依據證據置信度: 中

架構

可維護性

內容

社群

規範符合度

你可以打造什麼

製作行銷活動素材

為經審核的行銷活動生成符合品牌形象的圖片、短片、語音、音樂及字幕。

在本機完成影片製作

下載媒體、修剪場景、合併片段、替換音訊，並使用本機工具匯出可供交付的檔案。

研究社群討論

在撰寫內容或規劃人工推廣前，收集公開貼文及互動訊號。

試試這些提示

建立社群圖片

為 [product] 建立一張 9:16 的行銷活動圖片。使用目前啟用的品牌。顯示預估成本，並在生成前等待核准。

編輯產品影片

檢查 [video file]。修剪指定片段、加入經核准的字幕、保留來源長寬比，並在本機匯出 MP4。

研究行銷活動主題

在 LinkedIn、X 及 Reddit 上研究 [topic]。使用唯讀命令，並摘要反覆出現的主題、異議及附有出處的公開範例。

建立經審核的發佈工作流程

為 [campaign] 規劃多步驟發佈流程。生成素材、預估支出、使用試執行，並在每次發佈或寫入社群內容前要求明確核准。

最佳實務

開始付費工作前，確認目前啟用的帳號、組織、專案、預算及輸出路徑。
先使用唯讀命令及試執行，之後在發佈或傳送訊息前要求明確核准。
停用自動 Cookie 備份，並將驗證資料儲存在加密的系統認證資料儲存區中。

避免

請勿將 API 金鑰、密碼、工作階段 Cookie 或私人訊息貼入提示詞、日誌或共享輸出中。
請勿建立帳號、變換訊息內容或使用代理伺服器來規避平台的反濫用系統。
請勿將敏感媒體放置在可預測的共用暫存路徑中。

常見問題

此技能是否需要 Wonda 帳號？

需要。大多數生成、研究、發佈及雲端功能都需要驗證及付費方案。

它能否在不使用遠端算繪的情況下編輯媒體？

可以。許多具確定性結果的編輯及合成工作流程可使用 ffmpeg、Node.js 及 Chromium 在本機執行。

它能否發佈內容至社群平台？

可以，透過已連結的帳號即可。每次發佈或寫入社群內容前都應要求使用者明確核准。

它是否會儲存社群工作階段 Cookie？

會。文件記載的瀏覽器工作流程會將 Cookie 保存在本機，並可將其遠端備份。

它能否自動進行社群互動？

可以。此功能涉及帳號、同意、垃圾訊息及平台政策風險，應持續受到嚴格監督。

哪些 AI 助理可以使用此技能？

報告聲明此技能與 Claude、Codex 及 Claude Code 相容。

開發者詳細資訊

作者

degausai

授權

MIT

Skillstore 修訂

版本提示

作者未聲明版本。

儲存庫

https://github.com/degausai/wonda/tree/main/skills/wonda-cli/

引用

c43861a65bb95efcae259cd161c9d6f4dc7eec6f

維護新鮮度

2026/7/25

使用量

3 次下載 · 121 次瀏覽

檔案結構

📄 SKILL.md