微信公众号自动排版发布---一键安装

部署微信公众号发布Agent团队（画境视觉设计+数澜运营发布），含封面设计、排版美化、API发布、数据分析。使用 /wechat-publisher-setup 触发部署，需先安装 content-creation。

This package mostly does what it claims (deploys two local agents and provides a Node script to call WeChat APIs), but there are clear inconsistencies you should address before trusting it: 1) The SKILL.md tells you to store credentials at ~/.openclaw/workspace-wechat-publisher/.env, but the script (wechat_publish.cjs) reads ~/.openclaw/workspace-content-team/.env and caches tokens in that other directory. That means the script may read or write credentials in a different workspace than the one the installer creates. 2) The setup script invokes the openclaw CLI to register agents and requires certain existing agents; inspect the commands it will run (it uses execSync) and consider running it in a controlled environment or doing a dry run. Recommended actions: - Do not enter real AppID/AppSecret until you confirm and fix the path mismatch in wechat_publish.cjs (search for defaultEnvPath/defaultTokenCachePath and change to workspace-wechat-publisher). - Inspect the scripts locally (they are small) to verify they only contact api.weixin.qq.com and do not exfiltrate data elsewhere. - If you will use this on production credentials, back up your existing ~/.openclaw directory and run the setup in an isolated account or VM first. - Ask the skill author to correct the inconsistent workspace names and to explicitly declare which config path the script will use. If you cannot get a corrected version, consider manually deploying the templates and using a vetted WeChat publish tool instead.

Type: OpenClaw Skill Name: wechat-publisher-setup Version: 1.0.0 The skill bundle is designed to automate the setup of a WeChat publishing agent team, including visual design and operational analysis agents. It manages sensitive WeChat API credentials by prompting the user and storing them in a local .env file with restricted permissions (600). While there is a functional inconsistency (likely a copy-paste bug) where the publishing script (wechat_publish.cjs) looks for credentials in a different workspace directory than the one created by the setup instructions (SKILL.md), the behavior is entirely aligned with the stated purpose. No evidence of data exfiltration, malicious execution, or prompt injection was found.