WeWrite

微信公众号内容全流程助手：热点抓取 → 选题 → 框架 → 写作 → SEO/去AI痕迹 → 视觉AI → 排版推送草稿箱。 触发关键词：公众号、推文、微信文章、微信推文、草稿箱、微信排版、选题、热搜、 热点抓取、封面图、配图、写公众号、写一篇、主题画廊、排版主题、容器语法。 也覆盖：markdown 转微信格式...

In plain terms — the skill appears to do what it says (write and publish WeChat articles), but its code and runtime steps expect credentials and access that were not declared in the skill metadata, and it will look for config files beyond the skill folder and can pull code from the network. Before installing or running this skill: - Expect to provide WeChat credentials (appid + secret) if you want publishing/stats to work, and an image API key if you want image generation. The skill does not list these as required env vars, so supply them consciously and avoid putting other secrets in the same config file. - Review toolkit/wechat_api.py, scripts/fetch_stats.py, and toolkit/image_gen.py to confirm what is sent to external endpoints and whether any identifiers are logged or transmitted. - Be cautious about the 'git pull origin main' update step: running it will fetch and run remote code. Only run updates from a trusted repository or inspect the fetched changes before executing. - The scripts search multiple config locations (including ~/.config/wewrite/config.yaml). If you have unrelated configs in your home directory, move or inspect them; sensitive credentials there could be read. - Dependencies are installed ad-hoc via pip if needed; run pip install in a virtualenv or sandbox and inspect requirements.txt first. - If you want minimal risk, run the skill in an isolated environment (container or VM), give it only the credentials it needs for the features you intend to use, and avoid granting it broad access to your home directory or long-lived LLM keys unless necessary. If you want, I can list the specific files and lines that reference external endpoints, home paths, or LLM keys so you (or an admin) can audit them before use.

Type: OpenClaw Skill Name: wewrite Version: 1.1.3 The skill bundle is a sophisticated automation tool for WeChat Official Account management, covering the full lifecycle from trend fetching to draft publishing. While it handles sensitive credentials (WeChat AppID/Secret and AI API keys), the code in 'toolkit/wechat_api.py' and 'toolkit/publisher.py' uses these strictly for legitimate WeChat API interactions. The 'SKILL.md' includes a self-update feature via 'git pull', which is a high-privilege operation but is explicitly documented as a user-triggered utility. No evidence of data exfiltration, malicious obfuscation, or unauthorized remote execution was found across the scripts or instructions.