微信公众号发布工具

微信公众号发布工具 - 安全版 v2.8，支持 Knowledge-Base 主题、分步流程、一键发布，优化表格和 Markdown 渲染

What to consider before installing: - The tool legitimately needs your WeChat credentials (WX_APPID and WX_SECRET). Do not paste them into public places; prefer a .env file with chmod 600 or a secrets manager. The registry metadata did not declare these env vars — treat that as a transparency issue and ask the author to fix it. - The code caches tokens to /tmp/wechat_token.json; review that file if you run the tool and remove it if you rotate credentials. - SKILL.md suggests adding exports to ~/.bashrc which makes credentials persistent — avoid that if you don't want long-lived secrets in your shell profile. Use a secured .env or ephemeral environment variables instead. - Review the included Python files (wechat_mp_xk.py and others) yourself or run them in an isolated environment (container or VM) before providing real credentials. Check network endpoints used by the code (the token endpoint in the file is 'https://api.weixin.qq.com/cgi-bin/stable_token' — verify this is an expected/official endpoint for your account flow). - If you need higher assurance, ask the publisher to update the registry metadata to list required env vars and provide a provenance link (official homepage/repository) and sign or checksum releases.

Type: OpenClaw Skill Name: wechat-mp-xk Version: 2.8.0 The skill bundle is a legitimate tool for converting Markdown articles into WeChat Official Account drafts. It uses standard WeChat APIs (api.weixin.qq.com) for authentication, image uploading, and draft creation. Sensitive credentials like WX_APPID and WX_SECRET are handled via environment variables or .env files as per the documentation. While the tool caches access tokens in /tmp/wechat_token.json (a minor security weakness) and includes Alibaba Cloud affiliate links for promotion, there is no evidence of malicious intent, data exfiltration, or harmful prompt injection. The code logic in wechat_mp_xk.py and its variants is consistent with the stated purpose.