wechat article formatter pro

微信公众号智能排版引擎。输入草稿，AI 将自动润色、补全 Markdown 标签，并根据用户指定的主题色生成最终排版。

This skill appears coherent and focused: it converts drafted Markdown into a themed HTML file using bundled CSS. Before installing/using it: (1) ensure Python 3 and the Python 'markdown' package are available (the skill does not declare this dependency); (2) run it in a directory where writing draft_article.md and creating output_articles/ is acceptable (it may overwrite draft_article.md if present); (3) review the included Python files if you require extra assurance — they perform only local file I/O and HTML generation and make no network calls or credential accesses; (4) for extra safety, run the skill in an isolated/sandbox environment if the input or execution context is untrusted.

Type: OpenClaw Skill Name: wechat-article-formatter-pro Version: 1.0.0 The skill contains a path traversal vulnerability in 'wechat_template_generator.py' and 'skill_entry.py'. The 'theme_css' argument is passed directly from the command line to 'os.path.join' without sanitization, allowing an attacker to potentially read arbitrary local files (e.g., via '../../../../etc/passwd') and embed their contents into the generated HTML output. While the tool's logic for WeChat article formatting appears legitimate, the lack of path validation is a significant security flaw that could be exploited via prompt injection.