WeChat Channels Video Search

(已验证) 通过 TikHub API 搜索微信视频号视频(需要翻墙)，支持关键词搜索，返回视频下载链接和分析数据。

This skill does what it says (search TikHub) and needs your TikHub API token, but the included script prints your token and debug response text to stdout/stderr — that can leak your secret if you share console output or if an agent/operator captures it. Before installing or running: (1) review and remove or mask debug prints (remove print("token", token) and debug response logs), (2) store the token in a secure place and avoid sharing outputs that contain it, (3) consider setting TIKHUB token permissions minimally, (4) run the script locally in a controlled environment first and audit network calls (it calls https://api.tikhub.dev), and (5) if you plan to allow autonomous agent invocation, be cautious because the agent could call the skill and cause token exposure; disable autonomous invocation or require explicit user approval if you need stricter control.

Type: OpenClaw Skill Name: wechat-video-search Version: 1.0.1 The script `scripts/wechat_video_search.py` contains a significant security vulnerability where it explicitly prints the user's sensitive `tikhub_api_token` to standard output (`print("token",token)`). This behavior leaks credentials into logs or the agent's output history. Additionally, the script contains a hardcoded (though commented-out) API token. While the functionality aligns with the stated purpose of searching WeChat videos via the TikHub API (api.tikhub.dev), these information disclosure flaws pose a risk to the user's secret keys.