Wechat AutoPublish

自动化微信公众号文章发布，通过 API 创建和管理文章草稿，支持封面图和正文图片自动上传。用于：发布文章到公众号、创建内容草稿、自动化内容工作流、或设置定时发布系统。

This skill is internally coherent for publishing to WeChat, but take these practical precautions before running: 1) Store your AppID/AppSecret in config.json and add that file to .gitignore; restrict its filesystem permissions. 2) Verify apiBaseUrl in config.json remains the official https://api.weixin.qq.com unless you intentionally test against another host — otherwise tokens and uploads could be sent to an attacker-controlled endpoint. 3) Only allow image files from trusted directories; the scripts decide upload eligibility by file extension, not by inspecting file contents, so a sensitive file renamed to e.g. .jpg could be uploaded. 4) Protect the .tokens cache directory (set restrictive permissions) or change its location if needed. 5) Review the included scripts (publish_article.py / .js) in a safe environment and, if possible, run the first tests with a throwaway test account. If you need higher assurance, run the scripts in an isolated container and audit network traffic to confirm connections go only to WeChat endpoints.

Type: OpenClaw Skill Name: wechat-accounts-publisher Version: 1.0.1 The OpenClaw AgentSkills skill bundle is designed to automate publishing articles to WeChat公众号. Both the Python and Node.js scripts correctly implement the stated functionality, requiring file system access for configuration and image handling, and network access to the official WeChat API (api.weixin.qq.com) for authentication and content submission. The `SKILL.md` and `scripts/README.md` documentation explicitly advise users on security best practices, such as protecting `AppSecret` and using `.gitignore`. There is no evidence of intentional malicious behavior, unauthorized data exfiltration, arbitrary code execution, or prompt injection attempts against the AI agent. All observed behaviors are aligned with the skill's legitimate purpose.