全流程微信公众号自动发文 skill

Automate a full local WeChat Official Account publishing workflow: environment setup, content drafting, image prep, publishing, archiving, and optional sched...

This package largely does what it says — it includes documentation, shell templates, and a Node script (publish.mjs) that implements the WeChat publish flow (token, upload images, create draft, optional freepublish). Before running or installing: - Treat WECHAT_APP_ID and WECHAT_APP_SECRET as sensitive. The skill expects these to be provided externally (process env or .baoyu-skills/.env), but the registry metadata does not declare them — verify and supply them only in a safe .env you control. - Inspect any .baoyu-skills/.env or ~/.baoyu-skills/.env files the script will read to ensure they contain only intended keys; do not let the skill read an env file that contains unrelated secrets. - The included publish.mjs clears proxy environment variables to force direct connections to WeChat; if you rely on proxying for other services, be aware the script will mutate the environment (documented in the repo). That behavior is reasonable for direct WeChat API calls but could be surprising in multi-service setups. - The script makes network calls to api.weixin.qq.com and will perform publishing actions if valid credentials are present—test in a safe environment (draft_only, test account) before running against production accounts. - Ask the publisher/registry maintainer to update the package metadata to declare the required env vars (WECHAT_APP_ID, WECHAT_APP_SECRET, optional GOOGLE_API_KEY/GOOGLE_BASE_URL) so consumers are not misled. If you want me to, I can point to the exact lines in publish.mjs that read .env and perform network calls, or suggest a safe way to run the script (containerized, with a scoped .env) for testing.

Type: OpenClaw Skill Name: wechat-auto-publishing Version: 3.0.0 The skill bundle provides a comprehensive and legitimate workflow for automating WeChat Official Account publishing. It includes shell script templates (run.sh) and a standalone Node.js script (publish.mjs) designed to interact with official WeChat APIs (api.weixin.qq.com). The documentation (SKILL.md, security-boundary.md) explicitly emphasizes security best practices, such as excluding real credentials from the package and using environment variables. No evidence of data exfiltration, malicious execution, or harmful prompt injection was found; the code logic is transparent and aligned with the stated purpose.