Welight 公众号排版发布

Independently turn an article into WeChat Official Accounts compatible Markdown/HTML, present built-in theme choices, and publish to WeChat as a draft or for...

This skill appears to implement exactly what it claims (formatting, theme application, and publishing to WeChat). However, the package metadata omitted the runtime credentials it actually uses. Before installing or providing credentials: 1) Expect the publish flow to require WECHAT_APP_ID and WECHAT_APP_SECRET (or an equivalent config file) and to make outbound calls to api.weixin.qq.com or a configured proxy. 2) Do not supply your WeChat app secret unless you trust the source — prefer testing with a throwaway account or using a proxy that you control. 3) If you will let the agent fetch URLs or accept files, be aware it can reach arbitrary URLs (including internal endpoints if the agent has network access). 4) Review scripts/publish_wechat.py (it uploads images and posts drafts) and test with --dry-run before real publish. 5) If you need higher assurance, ask the author to update the registry metadata to declare required env vars and to document any proxy behavior; otherwise treat the missing credential declaration as a red flag.

Type: OpenClaw Skill Name: wechat-layout-publish Version: 1.0.1 The skill bundle provides a legitimate utility for converting articles into WeChat-compatible Markdown/HTML and publishing them to WeChat Official Accounts. The scripts (normalize_to_markdown.py, render_wechat_html.py, and publish_wechat.py) use Python's standard library to perform content fetching, regex-based transformation, and API interaction with WeChat's servers. While the skill handles sensitive credentials (appId/appSecret) and performs network requests, these actions are strictly aligned with the stated purpose of the tool. No evidence of data exfiltration, unauthorized execution, or malicious prompt injection was found.