← Back to Skills Marketplace
4044
Downloads
5
Stars
36
Active Installs
2
Versions
Install in OpenClaw
/install wechat-mp-publisher
Description
远程微信公众号发布技能。通过 HTTP MCP 解决家用宽带 IP 变动问题，支持大文件上传、多主题排版与一键发布。
Usage Guidance
Install only if you control or fully trust the configured wenyan-mcp server, prefer HTTPS with authentication, and are comfortable with that server receiving WeChat AppID/AppSecret and article content. Keep wechat.env out of version control with restrictive permissions, avoid the TOOLS.md credential path, and rotate credentials if they may have been exposed.
Capability Analysis
Type: OpenClaw Skill
Name: wechat-mp-publisher
Version: 2.0.2
The skill is classified as suspicious due to the inherent risk of transmitting sensitive WeChat credentials (AppID and AppSecret) to a user-configured remote server (wenyan-mcp) as part of its core functionality, which relies heavily on the trustworthiness of that remote endpoint. While this is the stated purpose, it represents a significant trust boundary. Additionally, the `scripts/setup.sh` file contains a shell parsing vulnerability that could be exploited if the `TOOLS.md` file were maliciously crafted, and the `README.md` contains a misleading statement about credentials not being stored on disk, when they are present in `wechat.env`.
Capability Assessment
Purpose & Capability
Publishing Markdown to a WeChat Official Account is coherent with the skill purpose, but it grants high-impact account authority and sends WECHAT_APP_ID/WECHAT_APP_SECRET plus article content to the configured remote wenyan-mcp service.
Instruction Scope
The docs disclose remote MCP use, but the example uses plain HTTP and does not clearly warn that credentials and unpublished content leave the local machine; README also claims credentials do not land on disk while SKILL.md instructs users to create wechat.env.
Install Mechanism
The manifest declares expected dependencies such as mcporter, curl, and jq, with no evidence of malicious install-time execution; users still need to create/manage local credential files.
Credentials
Credential use is expected for WeChat publishing, but sending long-lived AppSecret values to a user-configured remote server over the documented HTTP workflow is broader than many users would expect without stronger scoping and trust-boundary guidance.
Persistence & Privilege
The main persistent risk is local secret storage in wechat.env, and scripts/setup.sh still reads credentials from $HOME/.openclaw/workspace/TOOLS.md despite the current documentation presenting wechat.env as the isolated credential path.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install wechat-mp-publisher - After installation, invoke the skill by name or use
/wechat-mp-publisher - Provide required inputs per the skill's parameter spec and get structured output
Version History
v2.0.2
合规性优化：移除不安全的全局凭证读取，改为专用配置 wechat.env；增加依赖检查与本地回退机制。
v2.0.1
wechat-mp-publisher 2.0.1
- Adds support for remote publishing to WeChat Official Accounts via HTTP MCP, solving home broadband IP change issues.
- Enables large file uploads, multi-theme article formatting, and one-click publishing.
- Centralizes style and theme management on the remote server with device-independent access.
- Installation and use instructions updated for seamless remote setup.
- Improves compatibility with wenyan-cli Frontmatter conventions.
Metadata
Frequently Asked Questions
What is wechat-mp-publisher?
远程微信公众号发布技能。通过 HTTP MCP 解决家用宽带 IP 变动问题，支持大文件上传、多主题排版与一键发布。 It is an AI Agent Skill for Claude Code / OpenClaw, with 4044 downloads so far.
How do I install wechat-mp-publisher?
Run "/install wechat-mp-publisher" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is wechat-mp-publisher free?
Yes, wechat-mp-publisher is completely free (open-source). You can download, install and use it at no cost.
Which platforms does wechat-mp-publisher support?
wechat-mp-publisher is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created wechat-mp-publisher?
It is built and maintained by MISAKIGA (@misakiga); the current version is v2.0.2.
More Skills