wechat draft deleter

删除微信公众号草稿箱中的草稿。支持批量删除指定Media ID的草稿。

This skill appears to do what it claims (delete WeChat draft items) and uses only the official WeChat endpoints, but take these precautions before installing: - Metadata mismatch: the registry lists no required env vars but the tool requires WECHAT_APP_ID and WECHAT_APP_SECRET — expect to provide those. Do not rely on registry metadata alone. - Review README for hard-coded example credentials. Treat any concrete AppID/AppSecret in examples as potentially leaked; if you or your org used them, rotate/revoke immediately. - Inspect install.sh before running. It will pip install requests and create a symlink in /usr/local/bin; prefer installing inside a Python virtualenv to avoid global pip changes and reduce system impact. - Run the tool in a test account first (not production) to confirm behavior and to avoid irreversible deletes. - If you don't trust the source, avoid running install.sh; instead run scripts/delete_drafts.py directly from a checked-out copy after manual review. If you want higher confidence, ask the publisher for a trusted repository URL or signed release, and request that required env vars be declared in the registry metadata.

Type: OpenClaw Skill Name: wechat-draft-deleter Version: 1.0.0 The skill is a legitimate administrative utility designed to delete WeChat Official Account drafts using the official WeChat API (api.weixin.qq.com). The Python script `scripts/delete_drafts.py` correctly implements the OAuth flow and deletion requests, while the `install.sh` script performs standard CLI tool setup. No evidence of data exfiltration, unauthorized execution, or prompt injection was found; the code and documentation (SKILL.md, README.md) are consistent with the stated purpose.