read wechat article

Fetch and parse WeChat public articles by extracting clean content, metadata, images, word count, and reading time without browser rendering.

This skill appears to implement what it claims (WeChat article scraping and parsing) and doesn't request secrets, but review the following before running: 1) The code disables TLS verification (verify=False) — this makes requests vulnerable to MITM; consider changing to verify=True or explicitly handling cert issues. 2) setup.py contains malformed/trailing characters and the declared console entrypoint/handler may not match functions in the module; fix/verify packaging and entrypoints before pip-installing or publishing. 3) Running tests will perform real network requests; run them in an isolated environment or offline if you don't want outbound traffic. 4) Image-download and database helper functions perform disk/network I/O — only run them if you trust the source. If you need higher assurance, ask the maintainer for a clean setup.py, a clear main/handler function, and to remove/justify verify=False; run the package in a sandbox or ephemeral VM and audit network traffic on first runs.

Type: OpenClaw Skill Name: read-wechat-article Version: 1.0.0 The skill's core functionality aligns with its stated purpose of scraping WeChat articles. However, the `fetch_wechat_html` function in `read_wechat_article.py` uses `verify=False` for HTTPS requests, which disables SSL certificate verification. This is a significant security vulnerability, making the connection susceptible to Man-in-the-Middle attacks. While not indicative of intentional malicious behavior by the skill itself, it represents a critical flaw that could be exploited. The documentation (SKILL.md, README.md, PUBLISH_GUIDE.md) consistently emphasizes ethical use, disclaims commercial/bulk scraping, and does not contain prompt injection attempts.