自动收集15条AI新闻，生成HTML内容，并发布到微信公众号草稿箱，支持多模板和自定义发布时间。

This skill appears to implement a legitimate WeChat publishing workflow, but there are multiple red flags you should resolve before installing or entering credentials: - Do not provide your AppSecret or AppID until you verify the source. The package metadata does not declare required credentials, yet the code expects them (and reads WECHAT_APP_SECRET if set). - The documentation references additional scripts (install.sh, activate.py) that are not present in the package. Ask the maintainer for the complete source or inspect any missing files before use — missing activation/installation scripts could hide network calls. - Inspect publish.py fully (including the truncated/remaining code) or run it in a sandbox to see whether it contacts any servers other than api.weixin.qq.com (activation/licensing could contact external hosts). - Store AppSecret securely (prefer config file with strict permissions or a secrets manager). Avoid pasting secrets into third-party GUIs or unverified installers. - If you intend to buy/activate, verify payment/activation flow independently (the SKILL.md lists contacts and an external GitHub account). Do not authorize payments or send credentials until you confirm the provider's identity and hosting of activation logic. If you want, I can: - Inspect the rest of publish.py (the file was truncated) for any network calls or telemetry code if you provide the remaining lines, - Suggest a safe test plan (run in an isolated VM, monitor network traffic) or show how to redact AppSecret when sharing diagnostics.

Type: OpenClaw Skill Name: ly-wechat-publisher Version: 1.1.0 The skill bundle is a legitimate tool designed to automate the publication of AI news to WeChat Official Accounts. The core logic in `scripts/publish.py` handles authentication and content drafting via official WeChat API endpoints (api.weixin.qq.com) and includes a transparent local licensing system for a trial-to-paid model. While the script handles sensitive credentials like `app_secret`, there is no evidence of data exfiltration, unauthorized network calls, or malicious instructions in the documentation.