微信公众号内容总结

抓取微信公众号文章并转换为Markdown，提取正文内容后总结核心观点或直接输出完整文章。

This skill appears to do what it says: fetch a public mp.weixin.qq.com article, convert it to Markdown, optionally download images, and let the agent summarize or output the article. Before installing/running: 1) Review or run the included wechat2md.py in a sandbox to confirm behavior; 2) be aware it performs network requests and writes files (and the SKILL.md instructs you to delete generated .md files afterwards); 3) the SKILL.md suggests pip installing html2text/beautifulsoup4 into /tmp, which will download code from PyPI—only proceed if you trust those packages or install them via your usual package manager; 4) the script will not bypass WeChat JS verification or paywalled content; 5) consider copyright and privacy implications of fetching and storing article content and images. If you need stronger isolation, run the script in a container or VM.

Type: OpenClaw Skill Name: wechatsummarize Version: 1.0.0 The skill bundle is classified as suspicious due to shell injection vulnerabilities within the `SKILL.md` instructions. The instructions direct the AI agent to execute bash commands using unescaped placeholders for user-provided URLs and generated filenames (e.g., in `python3 wechat2md.py "<文章链接>"` and `rm -f ...`), which could be exploited to execute arbitrary commands if a malicious URL or article title is processed. While the `wechat2md.py` script itself appears to be a legitimate tool with basic filename sanitization, the integration pattern in the markdown documentation presents a significant security risk.