Wechat Mp Auto

自动完成微信公众号文章的选题调研、Markdown写作、智能配图、内容审核和发布全流程管理。

Summary of what to check before installing: 1) Metadata mismatch: the top-level registry listing said no env vars, but SKILL.md and metadata.json require WECHAT_APP_ID and WECHAT_APP_SECRET (or a config file at ~/.config/wechat-mp-auto/config.json). Do not run the skill without those WeChat credentials in a controlled environment. 2) Verify source and versions: metadata.json lists a GitHub homepage but the registry summary said none and several files contain inconsistent versions (src/_version.py, metadata.json, README, SKILL.md). Prefer installing from a trusted upstream repository and confirm version consistency. 3) Credential scope: the skill legitimately needs your WeChat AppID/Secret and optionally keys for Pexels/Unsplash/Tavily/OpenAI if you enable those features. Only provide API keys you trust and consider creating limited-scope/test accounts where possible. 4) Network behavior: the skill performs outbound requests for research (Tavily/DuckDuckGo/Baidu), image search/download (Pexels/Unsplash), and may call multiple AI image providers (many backends are listed). If you must protect sensitive network contexts, run the skill in an isolated environment or sandbox and ensure your server IP is added to your WeChat IP whitelist as required. 5) Check config files and caches: it will read/write ~/.config/wechat-mp-auto/* and ~/.cache/wechat-mp-auto/* and ~/.openclaw/.env. Inspect these locations after a test run; delete token cache files if you revoke credentials. 6) Run initial tests without real credentials: if possible, run the code in 'check-only' or dry-run modes (publish.py supports --check-only) to observe behavior before granting publish-level credentials. If you want, I can point out the exact files/lines where the WECHAT credential reads occur and where optional provider lists are defined, or produce a short checklist to safely test this skill in a sandboxed environment.

Type: OpenClaw Skill Name: wechat-mp-auto Version: 0.1.2 The wechat-mp-auto skill bundle is a legitimate and well-structured tool designed to automate the lifecycle of WeChat Official Account articles, including topic research, content generation, image processing, and publishing. It interacts with the official WeChat API and several third-party services (Tavily, Pexels, Unsplash, and various AI image providers) using credentials stored in standard configuration directories (~/.config/wechat-mp-auto/ and ~/.openclaw/). The code implements security best practices such as credential masking in logs (src/utils/logger.py), path validation for image downloads (src/skills/image_generator.py), and the use of list-based subprocess calls to prevent command injection (src/skills/image_processor.py). No evidence of malicious intent, unauthorized data exfiltration, or harmful prompt injections was found.