wechat-public-cli

Publish and download WeChat Public Platform content and Baijiahao articles via a local CLI.

This skill appears to do what it says, but take normal precautions before installing/running third-party CLIs: 1) Review the GitHub repo and the package.json (look for postinstall scripts) before installing globally; prefer npx or local install if you want to avoid a global binary. 2) Do not paste credentials into public places; use environment variables or a config file with restrictive filesystem permissions. 3) Treat WECHAT_APPID/WECHAT_SECRET and BJH_COOKIE/BJH_TOKEN as sensitive — use least-privilege credentials where possible. 4) Run the tool in an isolated environment (container or dedicated machine) if you are unsure about the package provenance. 5) If you need higher assurance, inspect the repository code (especially network calls, cookie handling, and any telemetry) to confirm there is no unexpected data exfiltration.

Type: OpenClaw Skill Name: wechat-public-cli Version: 1.0.4 The skill facilitates publishing content to WeChat and Baijiahao, requiring the handling of sensitive API credentials, secrets, and session cookies. It relies on shell execution for installation and operation (via `npm` and the `wechat-public-cli` tool) and performs network requests to external service providers. While these capabilities are aligned with the stated purpose, the requirement for high-privilege secrets and shell access presents a significant risk profile and potential for exploitation via prompt injection or malformed file paths in commands like `wechat:publish --file`.