Wechat Publish

One-click publishing of articles with custom images to WeChat official account draft, ensuring images use WeChat permanent material URLs.

This skill appears to implement a valid WeChat publish workflow, but there are important mismatches you should resolve before installing or running it: - Missing declarations: The SKILL.md requires WeChat appid/secret (access_token), docker, curl, python3, mmx CLI, and a local rendering service (http://localhost:3710), but the registry metadata declares none of these. Ask the publisher to explicitly list required binaries and required environment variables (APPID/SECRET or a primary credential). - Local access: The instructions perform docker cp and write to an agent workspace path. Only run this on a machine where you trust the skill and where exposing local containers/files is acceptable. - Secrets handling: The skill will require your WeChat app secret; never paste those into public places. Confirm how you will provide secrets (platform secret store vs inline) and ensure tokens are scoped and rotated. - Verify endpoints and container names: The runbook references container names (autocontents-makecontents-1) and localhost APIs; confirm these services actually exist in your environment to avoid accidental data leaks or command failures. - IP whitelist note: The doc lists an IP for WeChat whitelisting—ensure that IP is correct for your deployment and that you control or understand the networking implications. If you plan to use it, request an updated SKILL.md/metadata from the author that: declares required binaries and env vars, documents exact file and container requirements, and explains how secrets should be supplied and stored. If the author cannot provide that, treat the skill as untrusted and avoid running its Docker/file operations on sensitive hosts.

Type: OpenClaw Skill Name: wechat-publish Version: 1.0.0 The skill automates WeChat content publishing but requires high-risk capabilities, including Docker container access (docker cp) and shell execution for image processing and API interaction. It handles sensitive WeChat credentials (APPID/SECRET) and includes a hardcoded IP address (14.218.121.191) for whitelisting. While these actions are consistent with the stated purpose, the broad system access and potential for credential exposure via shell commands in SKILL.md warrant a suspicious classification.