智能微信公众号发布技能

自动收集15条AI新闻，生成HTML内容，并定时发布至微信公众号草稿箱，支持多模板和自定义发布时间。

Do not paste your WeChat AppSecret or AppID into this skill yet. The code you shipped does not show any actual news-collection logic (it uses static placeholders) and SKILL.md refers to install/activation scripts that are missing from the package — this could be an incomplete release or deliberately partial. Before installing or entering credentials: 1) request the full, un-truncated publish.py and the missing scripts (install.sh, activate.py) and review them for outbound network calls beyond api.weixin.qq.com; 2) verify where config/credentials will be stored on disk (~/.agents/... or the skill directory) and inspect those files for any upload/telemetry behavior; 3) if you must test, run the skill in an isolated environment (throwaway account or container) and monitor network traffic; 4) prefer to configure AppSecret in a per-skill config file rather than as a system-wide env var, and revoke/reset the AppSecret after testing if anything looks suspicious. The package's mismatches lower my confidence — clarifying the missing files and confirming the code that actually fetches news would move this toward 'benign.'

Type: OpenClaw Skill Name: smart-wechat-publisher Version: 1.1.4 The skill bundle is a functional tool for publishing content to WeChat Official Accounts. The Python script (scripts/publish.py) correctly handles WeChat API authentication, token caching, and draft creation using the official 'api.weixin.qq.com' endpoint. While the current version contains hardcoded news content as placeholders rather than a dynamic scraper, there is no evidence of credential exfiltration, unauthorized network activity, or malicious prompt injection. The monetization and licensing logic (usage.json/license.json) is implemented locally and transparently documented in SKILL.md and USER_GUIDE.md.