WeChat Official Account (公众号发文)

Create and publish WeChat Official Account (公众号) articles. Use when: (1) User wants to auto-post to WeChat Official Account, (2) Create draft from title + co...

This skill appears to do what it claims (API mode and browser automation). Before installing or running: 1) Prefer API mode (publish.py) with WECHAT_APPID/WECHAT_SECRET for lowest privacy risk. 2) If you must use browser mode, do NOT set external analyzer keys (DASHSCOPE_API_KEY / OPENAI_API_KEY) unless you trust that service — by default the skill points to a third-party DashScope endpoint which will receive sanitized page HTML that may still include sensitive state. 3) For best privacy, run a local analyzer (Ollama) and set WECHAT_MP_ANALYZER_BASE_URL to a localhost URL as documented. 4) Review and, if needed, fix the page_analyzer._call_openai bug (undefined 'model' variable) before relying on automated analysis. 5) Inspect and back up the browser profile directory (~/.openclaw/wechat-mp-browser) and avoid using browser mode on machines with other logged-in sensitive accounts. If you want, I can point out the exact lines to patch (the undefined variable) or show how to run the API-only flow safely.

Type: OpenClaw Skill Name: wechat-official-account Version: 1.0.2 The skill bundle provides legitimate tools for automating WeChat Official Account article publishing via official APIs (publish.py) or browser automation (publish_browser.py). While page_analyzer.py sends sanitized HTML content to external LLMs to drive the browser UI, this high-risk privacy behavior is explicitly disclosed in SKILL.md with clear warnings and instructions on using local models (Ollama) for better privacy. The code includes specific sanitization logic to redact sensitive tokens and lacks any evidence of intentional data exfiltration, backdoors, or malicious prompt injection.