Wechat Publisher Skill

Automatically collects 15 AI news items, generates HTML content, and publishes drafts to WeChat official accounts with customizable templates and scheduling.

This skill appears to implement a WeChat-publishing workflow, but there are several red flags you should consider before installing: 1) Metadata omission: the registry lists no required credentials while the skill needs AppID/AppSecret — confirm where and how you'll supply these securely. 2) Insecure instructions: the docs explicitly recommend hard-coding AppSecret into scripts and even show example secrets; never hard-code production credentials. 3) Review code: inspect scripts/publish.py yourself (or in a sandbox) to verify it only calls api.weixin.qq.com and legitimate sources; check token-cache and license behavior. 4) Sandbox network: run the skill in an isolated environment first to observe outbound requests (ip-api.com, WeChat API) and ensure no unexpected hosts are contacted. 5) Secrets handling: prefer storing credentials in a secure config store or environment variables with restricted file permissions; rotate any credentials used for testing. 6) Payment/activation: the activation/purchase flow is manual (contacting admin), so avoid providing personal payment info before you verify the author and repository. If you are not comfortable reviewing the code, treat this skill as untrusted and avoid installing it on a production machine or with high-privilege credentials.

Type: OpenClaw Skill Name: wechat-publisher-skill Version: 2.0.2 The skill bundle is a legitimate tool for automating AI news publication to WeChat Official Accounts. The Python script (publish.py) correctly implements WeChat's OAuth2 and Draft API flows, including token caching and IP detection via ip-api.com for whitelist configuration. While it includes a commercial monetization model (50-use trial and a 'buyout' license check), the logic is transparently handled via local JSON files (license.json, usage.json) and lacks any evidence of data exfiltration, malicious execution, or prompt injection.