Rss To Wechat

将 RSS 文章转换为微信公众号格式。适用于：发布 RSS/博客文章到微信、格式化内容以符合微信 API、自动化微信内容发布。

What to check before installing/using this skill: - Be aware this package includes runnable shell scripts that will fetch arbitrary web pages (curl) and execute user-configured scripts. Review every script (parse-article.sh, format-wechat.sh, publish-article.sh, and scripts referenced in config.local.sh) before running. - The repo expects WeChat credentials (WECHAT_APPID and WECHAT_APPSECRET) via a local config file (config.local.sh). The skill's registry metadata does not declare required secrets — treat this as a transparency issue. Only add credentials to a local file if you trust the author and are comfortable storing them locally. - parse-article.sh contains an explicit comment about "bypass[ing] web_fetch SSRF restriction". Ask the author to explain this or remove such behavior. Do not run the scripts in a privileged environment until you understand why the code claims to bypass platform protections. - COVER_SKILL and WECHAT_PUBLISH_SCRIPT point to arbitrary executables: do not set those to untrusted scripts. Inspect any cover/publish script output and verify it does not exfiltrate data or leak tokens. - Test in a sandbox: run scripts with a known safe URL and with credentials omitted to see dry-run behaviour (use --check and parse only). Configure a safe path for PUBLISH_HISTORY (it is referenced but not set by default) to avoid accidental writes. - If you need to proceed: run bash scripts/rss-to-wechat.sh --check, inspect config.local.sh, run parse-article.sh on a sample URL and review generated JSON/HTML before any publishing step. If anything is unclear or the author cannot justify the SSRF-bypass comment, avoid using automated publishing and keep execution manual.

Type: OpenClaw Skill Name: rss-to-wechat Version: 1.0.1 The skill bundle is designed to convert RSS feeds to WeChat articles but contains a notable security risk: `scripts/parse-article.sh` explicitly mentions using `curl` to bypass SSRF (Server-Side Request Injection) restrictions. While the scripts are functional and aligned with the stated purpose, the use of `curl` to fetch arbitrary user-provided URLs, combined with the handling of sensitive WeChat credentials (`WECHAT_APPID`, `WECHAT_APPSECRET`) in local configuration files, creates a high-risk surface for data exposure or internal network scanning if the agent is prompted with malicious URLs.