← Back to Skills Marketplace
393
Downloads
0
Stars
1
Active Installs
17
Versions
Install in OpenClaw
/install weread-import
Description
Export WeRead highlights and notes into Markdown files, usually into an Obsidian Reading folder. Use when the user asks to import or sync WeRead books, re-re...
Usage Guidance
This repository is coherent with its stated purpose, but please consider the following before installing or running: 1) The first run triggers `npm install --production` which will download 'playwright' and its browser artifacts — run this only on systems where you trust package installs or in an isolated environment. 2) The tool extracts WeRead cookies either from a provided cookie string or by connecting to a local Chrome CDP (127.0.0.1:9222). If you enable the legacy profile-sync mode (WEREAD_PROFILE_SYNC_MODE=legacy) the script will copy Chrome profile files (including Login Data) into the managed profile — avoid legacy mode unless you understand and accept that it accesses broader browser authentication artifacts. 3) To minimize risk, run initial tests with output directed to a temporary directory (e.g., /tmp/...) and use the provided scripts/prepare-staging-skill.sh to verify in a staging directory. 4) Inspect scripts/run.sh and scripts/open-chrome-debug.sh and, if unsure, run the tool inside a disposable VM/container. 5) If you want stronger assurance, review the code paths that call chromium.connectOverCDP and the cookie extraction functions; the network endpoints contacted are only weread.qq.com. If you want me to point to exact lines that copy profile files or perform cookie extraction, I can highlight them.
Capability Analysis
Type: OpenClaw Skill
Name: weread-import
Version: 0.3.9
The skill bundle contains high-risk functionality in `scripts/open-chrome-debug.sh` that can synchronize sensitive browser data. Specifically, the script includes logic to copy Chrome profile files, including `Cookies` and `Login Data` (which stores saved passwords), from the user's default Google Chrome directory to a local profile folder. While this behavior is intended to facilitate authentication for WeRead and is disabled by default (requiring `WEREAD_PROFILE_SYNC_MODE=legacy`), the capability to duplicate browser credentials and session tokens is a significant security risk. The rest of the code in `src/` and `scripts/run.sh` appears consistent with the stated purpose of exporting reading notes to Markdown.
Capability Assessment
Purpose & Capability
Name/description describe exporting WeRead highlights to Markdown; the repository contains a CLI, API calls to weread.qq.com, cookie extraction, rendering, merge/state management and file-writing. Required runtime items (Node, Playwright, optional access to Chrome CDP and an output directory) are coherent with that purpose.
Instruction Scope
SKILL.md directs the agent to run scripts/run.sh which: installs npm deps on first run, may launch or connect to Chrome via CDP and extract weread.qq.com cookies, write Markdown files to a user-provided output directory, and create a managed browser profile under ~/.weread-import-profile-isolated by default. These actions are expected for the tool, but they include reading browser cookies and optionally accessing Chrome profile files (see profile sync 'legacy' mode) — a privacy-sensitive operation the user must opt into.
Install Mechanism
There is no registry install spec; scripts/run.sh runs npm install --production in the repo on first run. package.json depends on 'playwright', which will be downloaded from the npm registry and (via Playwright's normal postinstall) may also fetch browser binaries. This is a standard but non-trivial network install that writes to disk and executes package install scripts — moderate risk compared to instruction-only skills.
Credentials
No unrelated cloud credentials are requested. The tool legitimately needs either a weread cookie (WEREAD_COOKIE or --cookie) or access to a local Chrome CDP to extract cookies. The env vars documented (WEREAD_COOKIE, WEREAD_CDP_URL, WEREAD_OUTPUT, etc.) match the functionality. Only caveat: legacy profile-sync mode will copy Chrome 'Login Data' and related files from the default Chrome profile into a managed profile — this grants access to broader browser auth artifacts and should be avoided unless intentionally required.
Persistence & Privilege
always:false (no forced always-on). The skill writes state files in the chosen output directory (.weread-import-state.json) and creates/uses a local managed browser profile under the user's home directory. It does not request persistent system-wide privileges or modify other skills. Still, it spawns Chrome and creates local files, so run it with care and choose an output/profile path you control.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install weread-import - After installation, invoke the skill by name or use
/weread-import - Provide required inputs per the skill's parameter spec and get structured output
Version History
v0.3.9
- Added new script: scripts/wait-browser-managed-ready.mjs
- This script supports readiness checks or coordination for the managed browser mode.
v0.3.8
No changes detected in this version.
- No file changes were detected from the previous release.
- Functionality and documentation remain unchanged.
v0.3.7
weread-import 0.3.7
- No file changes detected in this version.
- Documentation and usage instructions remain consistent with previous release.
v0.3.6
**Major update: Added browser session/management refactor and new test/utility scripts.**
- Introduced new browser session management modes: `browser-live` and `browser-managed`, with detailed usage distinction in documentation.
- Added session handling and browser management logic (`src/browser-mode.mjs`, `src/session.mjs`).
- Updated CLI parameters to support new cookie/browser handling options.
- Included staging preparation script (`scripts/prepare-staging-skill.sh`) and corresponding tests.
- Added automated tests for new functionality: browser mode and session management.
- Improved documentation reflecting new modes, correct usage, and environment requirements.
v0.3.5
- Added initial test file: tests/api.test.mjs
- Introduced basic testing infrastructure for API validation
v0.3.4
- No file changes detected in this release.
- No user-facing changes or updates.
v0.3.3
- WeRead sync tasks no longer stay alive after cookie extraction or auth failure due to leaked CDP connections
- --cookie-from browser is less likely to report false cookie expiration when the managed Chrome profile snapshot is stale
v0.3.2
- sort highlights and reviews by chapter order using live API chapter indexes
- sort highlights and reviews within a chapter by range position instead of create time when available
- preserve chapterIdx and range metadata in markdown so deleted archives can keep a stable sort order
- keep deleted chapters separated by chapterUid even when chapter names collide
- fix browser cookie extraction to include all cookies applicable to weread.qq.com, including host-only cookies like wr_gid
v0.3.1
weread-import 0.3.1
Changes
- fix highlight ordering within a chapter by sorting parsed bookmarkId positions before falling back to createTime
- support legacy bookmarkId values that only contain a single position number
v0.3.0
- Removed DOM mode support and related files; only API mode is now supported.
- Updated documentation to reflect the exclusive use of API mode for all import and sync actions.
- Added strict instructions and exit code handling for scheduled or automated runs, forbidding workaround parameters and automation pitfalls.
- Simplified available parameters, removing DOM-related options.
- Refined usage notes to clarify browser login and cookie refresh expectations.
v0.2.5
- Added environment example file: env.example.md.
- Introduced initial DOM extraction test: tests/dom.test.mjs.
- Updated documentation with more robust details on cookie handling and DOM mode verification.
- Clarified behaviors in auto and dom mode error fallback scenarios.
- Updated references to environment variable documentation filename (env.example.md).
v0.2.4
fix: resolve -2012 auth errors, add cache-busting, auto fallback to DOM, auto-start Chrome CDP
v0.2.3
no changes re-upload after clawhub update
v0.2.2
添加 CLAUDE.md 项目约定文档、文案润色
v0.2.1
Use bundled runtime and document bash run invocation
v0.2.0
Self-contained skill candidate with bundled CLI and local runtime setup
v0.1.0
Initial public release
Metadata
Frequently Asked Questions
What is WeRead Import?
Export WeRead highlights and notes into Markdown files, usually into an Obsidian Reading folder. Use when the user asks to import or sync WeRead books, re-re... It is an AI Agent Skill for Claude Code / OpenClaw, with 393 downloads so far.
How do I install WeRead Import?
Run "/install weread-import" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is WeRead Import free?
Yes, WeRead Import is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does WeRead Import support?
WeRead Import is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created WeRead Import?
It is built and maintained by GNIXNER (@gnixner); the current version is v0.3.9.
More Skills