WeChat Article Extractor

Extract full text and figures from a WeChat public account (微信公众号) article URL and save as a clean Markdown file. Handles WeChat's bot-detection by finding m...

This skill appears to do what it says: find mirror pages, download HTML, and convert to Markdown with a bundled Python script. Before installing: (1) Review the included Python script if you want to confirm no unexpected network destinations are embedded (it operates on local HTML files and does not perform remote uploads); (2) be aware images remain hotlinked to third-party hosts (mirrors/WeChat) — they may expire or track access; (3) the Chrome Relay fallback requires a browser extension — install only a trusted extension and understand it will allow a snapshot of the page to be read by the agent; (4) consider restricting file-save locations (avoid sensitive directories) and verifying outputs before publishing. If you want higher assurance, ask the author for a signed release or run the script in a sandbox to observe network activity.

Type: OpenClaw Skill Name: wechat-article-extractor Version: 1.0.0 The skill's core Python script (`scripts/extract_wechat.py`) is benign, performing local HTML parsing and Markdown conversion without network calls or arbitrary execution. However, the `SKILL.md` instructs the OpenClaw agent to use the `exec` tool with `curl` and `python3` commands, passing arguments derived from external sources (mirror URLs from `web_search` and article titles). If the agent's `exec` tool does not properly sanitize or quote these arguments, it could lead to shell injection, allowing arbitrary command execution. This represents a significant vulnerability (RCE risk) in the interaction between the skill's instructions and the agent's execution environment, classifying it as suspicious rather than malicious due to the lack of clear intentional harmful behavior from the skill's author.