Wechat Mp Publisher 1.0.0

Publish articles to WeChat Official Accounts via API using configured AppID, AppSecret, and IP whitelist with access token management.

This package appears to implement exactly what it claims (WeChat article publish) and contains no obvious exfiltration or strange remote endpoints — but the registry metadata fails to declare the required credentials. Before installing, verify the skill's source/owner (it's listed as 'unknown' / an opaque owner ID), and do the following: 1) Inspect index.js yourself (it’s included) to confirm there are no hidden network calls — the current code only calls WeChat APIs. 2) Only provide WECHAT_APPID and WECHAT_APPSECRET in a local .env and never commit that file to a repo. 3) Consider running the skill in an isolated environment (container or VM) and audit npm dependencies (npm audit) before npm install. 4) Ask the publisher to correct the registry metadata to declare the required env vars and primary credential so the skill listing matches its actual needs. If you cannot confirm the publisher identity, treat the package as untrusted and avoid providing live AppSecret values until you validate it.

Type: OpenClaw Skill Name: wechat-mp-publisher-1-0-0 Version: 1.0.1 The skill bundle is a legitimate tool for publishing articles to WeChat Official Accounts. The code in `index.js` correctly implements the official WeChat API flow (token acquisition, draft creation, and publishing) using standard libraries like `axios` and `dotenv`. No evidence of data exfiltration, malicious execution, or prompt injection was found; the file operations and network requests are strictly aligned with the stated purpose of the skill.