WeRead (微信读书)

微信读书（WeRead）数据查询与笔记管理技能。获取书架、搜索书籍、查看阅读进度/时长、获取笔记划线、热门书评、章节信息、随机笔记抽取和批量导出。当用户提到"微信读书"、"WeRead"、"书架"、"读书进度"、"划线"、"笔记"、"书评"、"在读"、"读完"、"阅读时长"、"读书回顾"、"导出笔记"时使用。

This skill needs your WeRead session cookie to access your account data — providing that cookie gives the skill the same access as your logged-in browser session (reads bookshelf, notes, highlights, etc.). The code appears to store everything locally under ~/.weread and only calls weread.qq.com. Before installing: (1) review the code yourself if you can (scripts are plain Python); (2) only run on a machine you trust and avoid pasting cookies on shared/remote hosts; (3) keep the cookie file permissions as 600 and remove the cookie file when you stop using the skill; (4) if you are concerned, create a disposable/new WeRead session and use that cookie (or revoke the session / rotate credentials after use). If you want extra assurance, run the scripts locally (inspect outputs) rather than granting the agent automated browser access to extract cookies.

Type: OpenClaw Skill Name: weread Version: 1.0.0 The skill provides legitimate functionality for managing WeRead data but includes high-risk credential handling behaviors. Specifically, `weread_login.py` attempts to programmatically access and query the Chrome browser's local `Cookies` SQLite database to extract session tokens. Additionally, `SKILL.md` instructs the AI agent to extract cookies via `document.cookie` and write them to a local file (`~/.weread/cookie`). While these actions are aligned with the stated purpose of the skill and the cookie extraction is limited to the `weread.qq.com` domain, the direct access to sensitive browser profile data and the automated handling of authentication secrets represent significant security risks.