WeChat MP Reader

Fetch WeChat Official Account articles from either a public account name or a WeChat article URL. Use when the user wants to extract full article content, id...

This skill does what it says (fetch WeChat articles and optionally use the WeChat MP backend), but pay attention to these points before installing or using it: - Sensitive session material: The skill can accept WECHAT_MP_COOKIE and WECHAT_MP_TOKEN from environment variables or obtain them via a QR login flow. When successful it will write session data and login state to files under scripts/cache/ (e.g., session.json, login-state.json). Those files contain cookies/tokens and should be treated as secrets — do not enable this on shared hosts or without auditing the code. - Missing dependency declarations: The skill relies on Python packages (requests and Playwright) and a runnable Playwright WebKit. The registry entry does not declare these dependencies or provide an install step, so the agent host may lack required binaries. Install Playwright and test in a controlled environment first. - Limit the blast radius: If you only need public-article extraction, prefer providing article URLs and avoid using the 'session' features (search/list) which require login. If you do use session features, run the skill in an isolated container/VM, inspect and delete the saved session files after use, and avoid supplying session material from accounts you cannot afford to expose. - Code review & provenance: The source owner is unknown and the package homepage is missing. If you will provide login credentials or use QR login, review the code paths that save and load cookies (scripts/wechat_mp_reader/session_store.py and qr_login.py) and confirm there are no unexpected network calls to endpoints other than mp.weixin.qq.com or obvious avatar/content URLs. - Operational hygiene: After use, remove saved session and state files from scripts/cache/, rotate any exposed credentials, and consider running the skill with minimal privileges and network access restricted to necessary domains.

Type: OpenClaw Skill Name: nasply-wechat-mp-reader Version: 0.1.1 The skill implements a WeChat Official Account reader that includes high-risk capabilities such as session management and an automated QR code login flow to capture authentication credentials (cookies and tokens). While these features are aligned with the stated purpose of accessing the WeChat MP backend, the script explicitly persists these sensitive credentials in plain text to a local JSON file (`scripts/cache/session.json`) and environment variables. The implementation in `scripts/wechat_mp_reader/qr_login.py` and `scripts/wechat_mp_reader/session_store.py` lacks encryption for stored secrets, which, combined with the inherent risks of automated login and session handling, warrants a suspicious classification despite the lack of clear malicious intent.