Wechat HTML Publisher

直接上传HTML富文本到微信公众号草稿箱。支持完整的HTML格式,无需Markdown转换。

This skill appears to implement its stated purpose, but take these precautions before installing or allowing autonomous runs: - Expect to set WECHAT_APP_ID and WECHAT_APP_SECRET (the SKILL.md and script require them) — the registry metadata incorrectly omits them. - Run the script locally first (not as an autonomous agent) to verify behavior and to ensure Python + requests are installed from trusted sources (pip install requests). - Review any HTML you feed it: the script will read local image paths (including absolute paths) and will download remote image URLs. Do not pass untrusted HTML because it could reference internal network URLs (SSRF) or local files you don’t want uploaded. - If you plan to let an agent invoke the skill autonomously, avoid running it on machines that have access to sensitive internal networks or metadata services; consider disabling autonomous invocation for this skill if you cannot fully trust the agent. - Rotate WeChat credentials if you suspect they were exposed during testing, and limit their permissions where possible. If you want this evaluated as 'benign' rather than 'suspicious', provide corrected registry metadata declaring the required environment variables and/or add explicit checks in the code to restrict URL/file fetching (e.g., deny private IP ranges, forbid file paths outside a safe directory).

Type: OpenClaw Skill Name: wechat-html-publisher Version: 1.0.2 The skill is a legitimate tool for publishing HTML content to WeChat Official Accounts. It uses standard environment variables for credentials and communicates only with official WeChat API endpoints (api.weixin.qq.com) to upload images and create drafts. No evidence of data exfiltration, malicious execution, or prompt injection was found in scripts/publish_html.py or SKILL.md.