Wechat Daily Article

微信公众号每日文章自动创作技能。搜索热点 → 撰写SEO优化文章 → 生成配图 → 上传草稿箱。含爆款标题模板、内容类型模板、搜一搜SEO优化。

This skill appears to implement what it claims, but there are important red flags you should address before installing or handing over credentials: - Missing manifest declarations: The skill bundle uses WECHAT_APPID and WECHAT_APPSECRET to get a WeChat access token, and optionally FEISHU_APP_ID/FEISHU_APP_SECRET/FEISHU_USER_OPEN_ID for notifications. The registry metadata lists no required env variables — confirm and require these be declared before use. - Secret exposure risk: Only provide the minimal-scoped WeChat and Feishu credentials the skill needs. Prefer creating limited-scope service accounts and rotate keys after testing. Do not reuse high-privilege or account-wide secrets. - Network & download behavior: The script will download arbitrary image URLs (from sites suggested in SKILL.md). Downloaded data is then uploaded to WeChat/Feishu. Consider running the skill in an isolated environment and validate image sources to avoid accidental malware downloads or copyright issues. - SSL verification disabled: create_draft.py disables SSL certificate verification when downloading images (ssl.CERT_NONE). This weakens transport security and can enable MITM. Insist this be fixed (use default SSL verification) before trusting the skill with secrets. - Inspect & audit code: Because the skill runs arbitrary network requests and handles secrets, review the included scripts (create_draft.py, feishu_sender.py) line-by-line or run them in a sandbox to ensure they only call the documented endpoints and do not exfiltrate data elsewhere. If you proceed: supply only the minimal credentials, test in an isolated account/agent, verify SSL behavior, and require the publisher to update the skill manifest to declare required env vars and a homepage/source for accountability.

Type: OpenClaw Skill Name: wechat-daily-article Version: 1.8.0 The skill bundle automates WeChat article creation but contains a significant security vulnerability in `scripts/create_draft.py`, where SSL certificate verification is explicitly disabled (`ssl.CERT_NONE`) during image downloads. This flaw exposes the agent to man-in-the-middle (MITM) attacks when fetching content from external URLs. While the code aligns with its stated purpose, the handling of sensitive credentials (WECHAT_APPSECRET, FEISHU_APP_SECRET) combined with the automated downloading of remote assets based on AI-generated content presents a high-risk surface for exploitation or prompt injection.