Wechat Mp Publisher

Enable automated publishing, media upload, draft management, and status querying for WeChat Official Account articles via WeChat MP API integration.

This package appears to implement exactly what it claims (WeChat MP article publishing) and legitimately needs your WeChat AppID and AppSecret, but the registry metadata omitted those required credentials and the package source/homepage are not provided. Before installing or granting access: 1) Verify the source/owner (unknown homepage) and prefer packages with known provenance. 2) Provide credentials via environment variables (WECHAT_MP_APP_ID / WECHAT_MP_APP_SECRET) rather than committing a config file. 3) Inspect the included code yourself or run npm install/build in an isolated environment (container or dedicated VM). 4) Confirm you are comfortable the token cache is stored under ~/.openclaw and that file permissions are acceptable (the code attempts 0o600/0o700). 5) If you only need drafts (no publishing), use a non-authenticated account or limit privileges on the account used for automation. 6) Because metadata omitted required env vars, treat this as a transparency issue — ask the publisher/registry for corrected metadata and provenance before enabling this skill in production.

Type: OpenClaw Skill Name: wechat-mp-publisher-zhizi Version: 2.0.3 The skill bundle is a well-implemented tool for managing WeChat Official Account articles and media. It demonstrates strong security awareness by implementing file permission checks (using 0o600 for sensitive token caches), providing error message desensitization to prevent path disclosure, and strictly limiting API interactions to the official WeChat domain (api.weixin.qq.com). No evidence of malicious intent, data exfiltration, or unauthorized execution was found across the source code (src/auth.ts, src/index.ts) or documentation.