微信公众平台文章全流程生产工具，涵盖选题、调研、撰写、去AI味、生成配图、HTML排版及提交草稿七个标准步骤。

This skill appears to implement the described WeChat article pipeline and ships scripts to humanize text, generate images, and submit drafts. However: (1) SKILL.md requires WECHAT_APPID and WECHAT_APPSECRET to be placed in ~/.openclaw/env, but the registry metadata does not declare those required env vars — confirm and correct metadata before installing. (2) Review scripts/submit-draft.js (and any network calls) to verify it only contacts the WeChat API and does not leak credentials to other endpoints. (3) npm install will pull puppeteer and many npm packages; ensure you run it in an isolated environment and are prepared for browser binaries (Node >=18 may be required). (4) Consider restricting automatic invocation: the SKILL.md's instruction to 'immediately use' on any article-related mention is broad — if you don't want the agent to run this skill automatically, disable autonomous invocation or require explicit user confirmation before submission. (5) Store AppSecret securely, run the skill on a server/IP you control (for WeChat IP whitelist), and rotate credentials after testing. If you want a higher confidence verdict, provide the full submit-draft.js source and confirm how environment variables are read at runtime.

Type: OpenClaw Skill Name: article-factory-wechat Version: 1.3.0 The bundle is a comprehensive toolset for automating the WeChat Official Account article production process, including AI text detection, humanization, and draft submission. The scripts (e.g., submit-draft.js and temp-convert.js) perform their stated functions using official WeChat API endpoints and Puppeteer for rendering. While the use of Puppeteer with '--no-sandbox' is a known security risk (vulnerability), it is a common requirement for certain environments and does not indicate malicious intent. No evidence of data exfiltration, credential theft, or malicious prompt injection was found.