wechat-pack

Convert local .docx or Markdown files into WeChat-ready HTML and generate a publish folder (source/assets/cover/wechat). Use when packaging documents for WeC...

This skill appears to do what it says, but review and be mindful of a few practical points before running: (1) The script will fetch external image URLs over the network — remote image hosts could record requests or attempt to track you, so only run on documents whose image sources you trust. (2) Converting .docx requires pandoc on PATH; installing pandoc is separate and you should obtain it from the official source. (3) Pillow and a Python markdown package are optional for extra features; install only from trusted package indexes. (4) The script writes files into a new output folder (source/, assets/, cover/, wechat/) — check the output and the script source if you want to confirm there is no undesired behavior. Overall the footprint is local and coherent with the stated purpose; no credentials or hidden endpoints were found.

Type: OpenClaw Skill Name: wechat-pack Version: 1.0.0 The skill is classified as suspicious due to significant vulnerabilities that could lead to local file disclosure and arbitrary URL fetching. The `scripts/pack_wechat.py` script, when processing user-provided input files, will copy local files referenced in `<img>` tags (e.g., `<img src="/etc/passwd">`) into the output `assets/` directory, making them accessible. Additionally, the script downloads images from arbitrary URLs specified in the input document or via the `--cover` argument, allowing the agent to make network requests to arbitrary external endpoints. While these capabilities are related to the skill's stated purpose, they represent critical vulnerabilities that could be exploited by a malicious user providing crafted input, without clear evidence of intentional malicious behavior by the script author.