wechat mp push 微信公众号图文生成与推送技能

支持通过AI生成符合公众号规范的图文（文章和贴图），并推送到公众号草稿箱，兼容其它SKILL生成的图文、图片进行推送。通过配置向导扫码授权，支持多账号。无需泄露公众号Secret密钥，无需配置公众号IP白名单。

What to check and do before installing or using this skill: - Inspect the code before running. The included file push-to-wechat-mp.js is the only executable; review it yourself (it is readable JS) and verify it only posts to the intended endpoint and only reads files in the skill directory. - Confirm Node.js availability and consider declaring node as a requirement. If you cannot or do not want to run node locally, do not run this skill. - Be careful when creating/supplying config.json. The workflow asks you to paste configuration JSON from a web wizard — verify the JSON contents locally before giving it to the agent or saving it in the skill folder. Do not paste any secrets you do not intend to share. - Verify apiBase in your config.json is the official service (default is https://api.pcloud.ac.cn/openClawService). Do not accept or use config files that set apiBase to unfamiliar domains or IPs; a malicious apiBase would receive all uploaded HTML and images. - Treat openId and any other identifiers as potentially sensitive. If you must use this skill for sensitive content, prefer authorizing your own official WeChat appId rather than using a shared/platform-provided account. - The SKILL.md contained a prompt-injection signal (unicode control chars). Proceed cautiously: do not allow the agent to autonomously request or accept arbitrary configuration or credentials via chat without you verifying them. - If you are unsure or cannot inspect files, run the script in an isolated/sandbox environment or decline to install. If you want, I can walk through the push-to-wechat-mp.js file line-by-line and highlight the exact network requests and JSON fields it sends so you can audit what will be transmitted.

Type: OpenClaw Skill Name: wechat-mp-push Version: 3.0.3 The skill facilitates content publishing to WeChat by executing a local Node.js script (push-to-wechat-mp.js) that sends user-generated HTML and a service-specific identifier (openId) to a third-party API (api.pcloud.ac.cn). While this behavior aligns with the stated purpose of bypassing WeChat's complex IP/Secret requirements, the use of shell execution, local file system access, and the exfiltration of content to an external proxy service represent high-risk capabilities. No evidence of intentional malice or unauthorized data theft (e.g., SSH keys or environment variables) was detected.