WeChat Article Digest

微信公众号文章抓取、分类与日报生成。当用户发送公众号文章链接（mp.weixin.qq.com）、说"文章日报"、"今日阅读"、"归类一下"、"整理文章"、"帮我看看这篇文章"时触发。也用于用户日常转发文章链接时自动抓取摘要和分类。

This skill appears to do what it says: scrape mp.weixin.qq.com article pages, extract title/author/body, generate a 1–2 sentence summary and 1–2 tags, and append the record to memory/YYYY-MM-DD.md for daily reports. Before installing, consider: (1) Ensure the agent environment has curl and python3 available (the SKILL.md uses them but metadata doesn't list required binaries). (2) Be aware fetched article contents are stored in memory files — if you forward private or sensitive links, their contents will be persisted. (3) The skill executes shell and Python commands (via exec); run in a trusted/sandboxed agent if you have concerns about executing commands in your environment. (4) Scraping WeChat pages may sometimes fail or return obfuscated content; the skill's regex-based extraction is brittle. If any of these are unacceptable, ask the publisher to declare required binaries, to avoid exec usage, or to change storage behavior before enabling the skill.

Type: OpenClaw Skill Name: wechat-article-digest Version: 1.0.0 The skill contains a shell injection vulnerability in SKILL.md by directly embedding user-provided URLs into a shell command string using the `exec` tool (curl | python3). While the logic is consistent with its stated purpose of scraping WeChat articles, the lack of input sanitization for shell execution is a high-risk flaw, though no clear evidence of malicious intent or exfiltration was found.