微信小程序 CI 工具

微信小程序 CI 工具技能。支持构建、预览、云函数、云存储等全部 miniprogram-ci 能力。使用 Node.js 开发，跨平台，可配置。

This skill appears to implement a legitimate miniProgram CI wrapper, but take precautions before running anything: 1) Inspect scripts/wx-miniprogram-ci.js to confirm whether it will run npm installs or external commands automatically and where it writes files. 2) Back up any existing ~/.wxmini-ci.config.js before running the skill or tests — the provided tests (tests/run-tests.js) copy a test config to your real config path and may overwrite it without preserving the original. 3) Keep your WeChat private key files safe: the tool accepts privateKeyPath and reads that file; only point it at keys you intend to use. 4) Run the tool in an isolated environment or sandbox (or with a temporary home) if you want to verify behavior first. If you need higher confidence, ask the skill author for a clear statement of whether the script automatically installs packages (and for safer test behavior that does not overwrite user config).

Type: OpenClaw Skill Name: wx-miniprogram-ci Version: 1.0.1 The skill bundle contains a destructive test script and high-privilege operations. Specifically, `tests/run-tests.js` overwrites the user's global configuration file (`~/.wxmini-ci.config.js`) with an empty object without creating a proper backup, leading to permanent data loss of WeChat Mini Program credentials if executed. Additionally, `scripts/wx-miniprogram-ci.js` performs global package installations (`npm install -g`) and uses `require()` to load a configuration file that the script itself modifies, which is a risky pattern that could be exploited if the file content is compromised. While these appear to be significant engineering flaws rather than intentional malware, the destructive nature of the test suite and the handling of sensitive private keys warrant a suspicious classification.