← 返回 Skills 市场
WeChat MP Multi-Publisher
作者
x402spark-jpg
· GitHub ↗
· v1.0.0
985
总下载
3
收藏
7
当前安装
1
版本数
在 OpenClaw 中安装
/install wechat-multi-publisher
功能描述
Publish one or multiple Markdown articles to WeChat Official Account (公众号) draft box in a single API call. Supports multi-article combined drafts (main artic...
安全使用建议
This skill appears to implement a legitimate WeChat MP publisher, but there are important red flags to consider before installing: (1) the registry metadata claims no required env vars, but both SKILL.md and the script need WECHAT_APP_ID and WECHAT_APP_SECRET (or a credentials file) — verify this mismatch and treat the credentials as sensitive; (2) the script will read local markdown and image files and upload images to Unsplash and WeChat endpoints — ensure you only process non-sensitive files and run a dry-run first; (3) the package depends on @wenyan-md/core (install manually after auditing that package); (4) source/homepage/owner provenance is limited — prefer skills with a known repository or verify the publish.mjs source fully before use. Recommended actions: inspect the full publish.mjs file locally, run the --dry-run mode first, create and use a minimal-scope WeChat test account for credentials, whitelist only trusted server IPs, and review the @wenyan-md/core dependency before npm install.
功能分析
Type: OpenClaw Skill
Name: wechat-multi-publisher
Version: 1.0.0
The skill's behavior is clearly aligned with its stated purpose of publishing Markdown articles to WeChat Official Accounts. It accesses WeChat API credentials from environment variables or a standard configuration file (`~/.config/wechat-mp/credentials.json`), reads user-provided Markdown files, and makes network calls to the WeChat API and Unsplash (for cover images). All file system and network operations, as well as credential handling, are necessary for its functionality. There is no evidence of data exfiltration to unauthorized endpoints, arbitrary command execution, persistence mechanisms, prompt injection against the agent, or obfuscation. The `npm install` and `crontab` instructions are for the user/agent to set up and automate the skill, not malicious code executed by the skill itself.
能力评估
Purpose & Capability
The skill's stated purpose (publishing Markdown to WeChat MP) matches the included script's behavior (rendering markdown, uploading covers/inline images, creating drafts). However the registry metadata listed no required environment variables or primary credential, while the SKILL.md and scripts clearly require WECHAT_APP_ID and WECHAT_APP_SECRET (or a credentials file). That discrepancy between declared metadata and actual requirements is a material inconsistency.
Instruction Scope
Runtime instructions and the script direct the agent to read credentials from env vars or ~/.config/wechat-mp/credentials.json, read local markdown and image files, render HTML, upload inline images to WeChat CDN, fetch cover images from Unsplash, and call WeChat APIs. Those actions are within the claimed purpose but are broader than the registry's 'no env vars' claim. The instructions will access local filesystem paths and network endpoints (api.weixin.qq.com, source.unsplash.com, images.unsplash.com), so users should expect local files and credentials to be used and transmitted to remote services.
Install Mechanism
There is no formal install spec in the registry (instruction-only), but SKILL.md and references/setup.md instruct the user to run `npm install @wenyan-md/core`. This is a moderate-risk pattern because dependencies are not installed automatically by a verified installer; the dependency should be audited before installation. The code itself is bundled (publish.mjs) rather than downloaded from a remote URL at install time, which reduces arbitrary remote-install risk.
Credentials
The script requires sensitive credentials (WECHAT_APP_ID and WECHAT_APP_SECRET) and can read a credentials file under ~/.config/wechat-mp. Those credentials are necessary for interacting with WeChat APIs, so their request is proportionate to the skill's functionality — but the registry metadata failed to declare them. That omission increases risk because automated gating or reviewers might not have flagged credential needs. The skill also suggests setting WECHAT_AUTHOR; no other unrelated secrets are requested in the code.
Persistence & Privilege
The skill does not request permanent 'always' inclusion, does not claim to modify other skills or global agent settings, and does not include an install step that writes persistent privileged configuration. It only reads a per-user credentials file and environment variables, which is expected for this purpose.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install wechat-multi-publisher - 安装完成后，直接呼叫该 Skill 的名称或使用
/wechat-multi-publisher触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.0
Multi-article combined draft push: main + sub-articles in one API call. Smart cover images (Unsplash auto-match + 12-image fallback rotation, each article gets a unique cover). Custom styling: gold quote highlights, && section dividers, accent headings. Inline image auto-upload to WeChat CDN.
元数据
常见问题
WeChat MP Multi-Publisher 是什么？
Publish one or multiple Markdown articles to WeChat Official Account (公众号) draft box in a single API call. Supports multi-article combined drafts (main artic... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 985 次。
如何安装 WeChat MP Multi-Publisher？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install wechat-multi-publisher」即可一键安装，无需额外配置。
WeChat MP Multi-Publisher 是免费的吗？
是的，WeChat MP Multi-Publisher 完全免费（开源免费），可自由下载、安装和使用。
WeChat MP Multi-Publisher 支持哪些平台？
WeChat MP Multi-Publisher 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 WeChat MP Multi-Publisher？
由 x402spark-jpg（@x402spark-jpg）开发并维护，当前版本 v1.0.0。
推荐 Skills