Wechat Publisher Skill

Automatically collects 32 AI news items, formats in fixed block layout v3.0 HTML, and publishes drafts to a WeChat official account with customizable schedul...

This skill appears to be a legitimate WeChat publisher, but there are several issues you should consider before installing: - Required secrets: the skill needs your WeChat AppID and AppSecret (expected). Do NOT follow the docs' recommendation to "hard‑code" these into scripts — instead store them in a protected config or environment variable and limit file permissions. - Manifest/document mismatch: the registry metadata omits required config/env declarations and the SKILL.md/documents reference files and install scripts that are not present. Treat the package as somewhat untrusted until the author clarifies these inconsistencies. - Local file access: docs reference comparing/reading a cache at D:\news and the skill writes token/usage/license files under its memory directory. Verify what local files the skill will read/write and ensure it won’t access sensitive directories you care about. - Dependency handling: the Python script depends on requests; because there is no install spec, the skill may fail or prompt you to pip‑install dependencies. Consider installing in a controlled environment (container or VM) first. - Payment/activation: the buy/activation flow involves contacting third‑party accounts (WeChat, email). If you plan to pay, verify the seller independently (e.g., GitHub repo, trusted contact) before sending money. If you want to proceed, run the skill in an isolated environment (or review the rest of the script not shown here) and confirm the script's exact filesystem reads/writes and network calls. Ask the maintainer to (1) declare required env/configs in the registry metadata, (2) remove the hard‑coding recommendation, and (3) provide a reproducible install/verification procedure.

Type: OpenClaw Skill Name: wechat-publisher-403914291 Version: 2.0.3 The skill bundle is a legitimate automation tool for publishing AI-related news to WeChat Official Accounts. The core logic in `scripts/publish.py` handles sensitive credentials (AppID/AppSecret) appropriately via environment variables or local configuration files and communicates only with official WeChat API endpoints (api.weixin.qq.com) and a standard IP detection service (ip-api.com). The bundle includes a local trial and licensing mechanism (8.8 RMB buy-out) that operates transparently without exfiltrating data to the author. No evidence of malicious prompt injection, unauthorized data exfiltration, or hidden execution was found across the code or the extensive documentation.