Wemp Ops

微信公众号全流程运营：选题→采集→写作→排版→发布→数据分析→评论管理。 Use when: (1) 用户要写公众号文章或提供了选题方向, (2) 用户说"写一篇关于XXX的文章"/"帮我写篇推文"/"出一篇稿子", (3) 用户要求采集热点/素材/竞品分析, (4) 用户提到公众号日报/周报/数据分析/阅读量/...

Key things to check before installing: - Inspect config/default.json and other repo files for embedded secrets; treat the included weixin.appId/appSecret as suspicious (they may be real or stolen). Do NOT use the skill unless you remove/replace those credentials with your own and ensure secrets are stored securely (env vars or a secret manager). - Review scripts/setup.mjs, publisher.mjs, smart_collect.mjs, and any network-calling code to see exactly which endpoints are contacted (WeChat API endpoints, image-generation services, or arbitrary hosts). If you are uncomfortable, run the skill in an isolated sandbox or container first. - Confirm where image-generation API keys (Gemini/Seedream or other) are expected to come from; SKILL.md references 'team AK' and key rotation but does not declare required env vars — ask the publisher for details or set your own credentials. - Note the skill will read and write workspace files and may delete handoff items; back up your workspace before first run and audit what files the scripts modify. - If you intend to allow publishing/comment-reply capabilities, ensure the WeChat credentials are yours and have the minimum required scope (prefer a test account), and consider disabling autonomous invocation until you've validated behavior. - If anything about provenance (who published this skill) is unclear, prefer not to run arbitrary setup or publishing scripts from it; ask the author for an explanation of the embedded credentials and a sanitized install process (declared env vars, no hardcoded secrets).

Type: OpenClaw Skill Name: wemp-ops Version: 1.0.4 The bundle is a comprehensive and legitimate toolset for managing WeChat Official Account operations, including content aggregation, AI-assisted writing, and automated publishing. It utilizes official WeChat APIs (api.weixin.qq.com) and standard news sources (e.g., HackerNews, V2EX, Weibo) for its functionality. While the scripts use sub-processes to bridge Node.js and Python components (e.g., in publisher.mjs and markdown_to_html.py), this behavior is consistent with the stated purpose of converting and uploading content. No evidence of data exfiltration, malicious persistence, or harmful prompt injection was found; the instructions in SKILL.md are focused on maintaining a specific writing persona and content quality.