← 返回 Skills 市场
Wechat Xhs Publisher
作者
achievejia
· GitHub ↗
· v1.0.0
· MIT-0
245
总下载
0
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install wechat-xhs-publisher
功能描述
微信公众号与小红书一键发布工具。当需要将热点新闻改写成公众号文章并发布到微信公众号和小红书时使用,包括:1)根据热点新闻改写公众号文章 2)使用AI生成文章配图 3)发布前IP检测 4)发布到微信公众号 5)发布到小红书。触发场景:热点新闻发布、公众号文章发布、小红书种草、社交媒体同步发布。
安全使用建议
Before installing or using this skill: 1) Recognize the metadata is incomplete — the SKILL.md expects node/npx/bun and mcporter and will run npx -y which downloads and executes packages at runtime (this can run arbitrary code). 2) Confirm where and how WeChat/Xiaohongshu credentials will be provided and whether the referenced tools (baoyu-post-to-wechat, mcporter, wechat-ip-checker) are trusted and already configured. 3) Inspect the workspace file {workspace}/wechat_ip_config.md and ensure it contains only the IP record (no tokens/credentials). 4) If you must test, do so in an isolated environment or sandbox account to avoid accidental public posting. 5) Prefer explicit declaration of required binaries and environment variables from the skill author, and ask for documentation on the external tools it invokes and how they handle authentication and network traffic.
功能分析
Type: OpenClaw Skill
Name: wechat-xhs-publisher
Version: 1.0.0
The skill bundle facilitates automated social media publishing but includes high-risk behaviors such as executing shell commands via 'npx' and 'mcporter' (SKILL.md). It also performs external network requests to a third-party IP lookup service (ip38.com) to verify the public IP before publishing. While these actions are aligned with the stated purpose of managing WeChat and Xiaohongshu accounts, the execution of external scripts and the transmission of the user's IP address to a third-party service represent significant security and privacy risks.
能力评估
Purpose & Capability
The skill claims to publish to WeChat and Xiaohongshu and the instructions do that, but it delegates publishing to external tools (baoyu-post-to-wechat, mcporter) and an IP-checker skill. The registry metadata declares no required binaries or credentials, yet the runtime commands (npx, bun, mcporter, mcporter call, image API) clearly require specific tools and likely account credentials. The absence of declared requirements is an incoherence.
Instruction Scope
Instructions are focused on the stated workflow: generate article, generate images, check public IP, then publish. They reference network endpoints (ip38.com and image APIs) and call other local/third-party tools. They instruct reading/writing workspace files (post-to-wechat/YYYY-MM-DD/, img/, {workspace}/wechat_ip_config.md) which is within the task's scope. However, they also instruct running npx -y bun scripts/wechat-api.ts (which will execute downloaded code) and calling mcporter — both of which may perform arbitrary network I/O and require credentials not declared here.
Install Mechanism
There is no install spec (instruction-only), which is lower risk in principle, but the runtime relies on commands that will fetch/run code at execution (npx -y bun ...). Using npx -y invokes package download/execution from registries at runtime, which can execute arbitrary code. The skill does not declare required binaries (node/npx/bun/mcporter), so the metadata is inconsistent with the commanded runtime environment.
Credentials
The skill declares no required environment variables or primary credential, yet publishing to WeChat and Xiaohongshu will require authentication tokens/credentials handled by the referenced tools. That mismatch leaves it unclear how credentials are supplied and audited. The skill also reads a workspace config file for an IP whitelist — verify this file doesn't store other secrets. Network endpoints and image-generation APIs may require API keys not declared here.
Persistence & Privilege
The skill does not request always:true, does not modify other skills, and is instruction-only. It writes files into the workspace and invokes other tools, which is expected for a publishing workflow. Autonomous invocation is allowed by default but is not in itself a new risk here.
如何使用
- 确保已安装 OpenClaw(本地或 Docker 部署)
- 在对话框中输入安装命令:
/install wechat-xhs-publisher - 安装完成后,直接呼叫该 Skill 的名称或使用
/wechat-xhs-publisher触发 - 根据 Skill 的参数说明提供必要输入,即可获得结构化输出
版本历史
v1.0.0
Initial release of wechat-xhs-publisher.
- One-click tool for rewriting and publishing trending news to WeChat Official Accounts and Xiaohongshu.
- Automates article creation, AI image generation, IP checking, and publishing.
- Includes workflow for organizing content, images, and API integration.
- Ensures IP security and proper image handling for both platforms.
- Provides clear instructions and troubleshooting guidance.
元数据
常见问题
Wechat Xhs Publisher 是什么?
微信公众号与小红书一键发布工具。当需要将热点新闻改写成公众号文章并发布到微信公众号和小红书时使用,包括:1)根据热点新闻改写公众号文章 2)使用AI生成文章配图 3)发布前IP检测 4)发布到微信公众号 5)发布到小红书。触发场景:热点新闻发布、公众号文章发布、小红书种草、社交媒体同步发布。 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件,目前累计下载 245 次。
如何安装 Wechat Xhs Publisher?
在 OpenClaw 或 Claude Code 对话框中运行命令「/install wechat-xhs-publisher」即可一键安装,无需额外配置。
Wechat Xhs Publisher 是免费的吗?
是的,Wechat Xhs Publisher 完全免费,采用 MIT-0 许可证,可自由下载、安装和使用。
Wechat Xhs Publisher 支持哪些平台?
Wechat Xhs Publisher 跨平台运行,可在任意部署了 OpenClaw / Claude Code 的环境中使用(cross-platform)。
谁开发了 Wechat Xhs Publisher?
由 achievejia(@achievejia)开发并维护,当前版本 v1.0.0。
推荐 Skills