← Back to Skills Marketplace
achievejia

Wechat Xhs Publisher

by achievejia · GitHub ↗ · v1.0.0 · MIT-0
cross-platform ⚠ suspicious
245
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install wechat-xhs-publisher
Description
微信公众号与小红书一键发布工具。当需要将热点新闻改写成公众号文章并发布到微信公众号和小红书时使用,包括:1)根据热点新闻改写公众号文章 2)使用AI生成文章配图 3)发布前IP检测 4)发布到微信公众号 5)发布到小红书。触发场景:热点新闻发布、公众号文章发布、小红书种草、社交媒体同步发布。
Usage Guidance
Before installing or using this skill: 1) Recognize the metadata is incomplete — the SKILL.md expects node/npx/bun and mcporter and will run npx -y which downloads and executes packages at runtime (this can run arbitrary code). 2) Confirm where and how WeChat/Xiaohongshu credentials will be provided and whether the referenced tools (baoyu-post-to-wechat, mcporter, wechat-ip-checker) are trusted and already configured. 3) Inspect the workspace file {workspace}/wechat_ip_config.md and ensure it contains only the IP record (no tokens/credentials). 4) If you must test, do so in an isolated environment or sandbox account to avoid accidental public posting. 5) Prefer explicit declaration of required binaries and environment variables from the skill author, and ask for documentation on the external tools it invokes and how they handle authentication and network traffic.
Capability Analysis
Type: OpenClaw Skill Name: wechat-xhs-publisher Version: 1.0.0 The skill bundle facilitates automated social media publishing but includes high-risk behaviors such as executing shell commands via 'npx' and 'mcporter' (SKILL.md). It also performs external network requests to a third-party IP lookup service (ip38.com) to verify the public IP before publishing. While these actions are aligned with the stated purpose of managing WeChat and Xiaohongshu accounts, the execution of external scripts and the transmission of the user's IP address to a third-party service represent significant security and privacy risks.
Capability Assessment
Purpose & Capability
The skill claims to publish to WeChat and Xiaohongshu and the instructions do that, but it delegates publishing to external tools (baoyu-post-to-wechat, mcporter) and an IP-checker skill. The registry metadata declares no required binaries or credentials, yet the runtime commands (npx, bun, mcporter, mcporter call, image API) clearly require specific tools and likely account credentials. The absence of declared requirements is an incoherence.
Instruction Scope
Instructions are focused on the stated workflow: generate article, generate images, check public IP, then publish. They reference network endpoints (ip38.com and image APIs) and call other local/third-party tools. They instruct reading/writing workspace files (post-to-wechat/YYYY-MM-DD/, img/, {workspace}/wechat_ip_config.md) which is within the task's scope. However, they also instruct running npx -y bun scripts/wechat-api.ts (which will execute downloaded code) and calling mcporter — both of which may perform arbitrary network I/O and require credentials not declared here.
Install Mechanism
There is no install spec (instruction-only), which is lower risk in principle, but the runtime relies on commands that will fetch/run code at execution (npx -y bun ...). Using npx -y invokes package download/execution from registries at runtime, which can execute arbitrary code. The skill does not declare required binaries (node/npx/bun/mcporter), so the metadata is inconsistent with the commanded runtime environment.
Credentials
The skill declares no required environment variables or primary credential, yet publishing to WeChat and Xiaohongshu will require authentication tokens/credentials handled by the referenced tools. That mismatch leaves it unclear how credentials are supplied and audited. The skill also reads a workspace config file for an IP whitelist — verify this file doesn't store other secrets. Network endpoints and image-generation APIs may require API keys not declared here.
Persistence & Privilege
The skill does not request always:true, does not modify other skills, and is instruction-only. It writes files into the workspace and invokes other tools, which is expected for a publishing workflow. Autonomous invocation is allowed by default but is not in itself a new risk here.
How to Use
  1. Make sure OpenClaw is installed (local or Docker)
  2. Run the install command in chat: /install wechat-xhs-publisher
  3. After installation, invoke the skill by name or use /wechat-xhs-publisher
  4. Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Initial release of wechat-xhs-publisher. - One-click tool for rewriting and publishing trending news to WeChat Official Accounts and Xiaohongshu. - Automates article creation, AI image generation, IP checking, and publishing. - Includes workflow for organizing content, images, and API integration. - Ensures IP security and proper image handling for both platforms. - Provides clear instructions and troubleshooting guidance.
Metadata
Slug wechat-xhs-publisher
Version 1.0.0
License MIT-0
All-time Installs 0
Active Installs 0
Total Versions 1
Frequently Asked Questions

What is Wechat Xhs Publisher?

微信公众号与小红书一键发布工具。当需要将热点新闻改写成公众号文章并发布到微信公众号和小红书时使用,包括:1)根据热点新闻改写公众号文章 2)使用AI生成文章配图 3)发布前IP检测 4)发布到微信公众号 5)发布到小红书。触发场景:热点新闻发布、公众号文章发布、小红书种草、社交媒体同步发布。 It is an AI Agent Skill for Claude Code / OpenClaw, with 245 downloads so far.

How do I install Wechat Xhs Publisher?

Run "/install wechat-xhs-publisher" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.

Is Wechat Xhs Publisher free?

Yes, Wechat Xhs Publisher is completely free, licensed under MIT-0. You can download, install and use it at no cost.

Which platforms does Wechat Xhs Publisher support?

Wechat Xhs Publisher is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).

Who created Wechat Xhs Publisher?

It is built and maintained by achievejia (@achievejia); the current version is v1.0.0.

💬 Comments