wx-md-article

Automatically generate WeChat public account articles from Markdown and upload them to the draft folder with clean, professional formatting and color rules.

This skill does what it says (converts Markdown and uploads to WeChat) but the package includes a config.json with an appid and appsecret embedded. Do NOT use those credentials. Before installing or running: (1) Replace the appid/appsecret in config.json with your own WeChat credentials (or modify the scripts to read credentials from a secure location or env vars); (2) Rotate the embedded credentials if you control the referenced account, and avoid uploading sensitive content while using third-party credentials; (3) Be aware the script prints part of the access_token to stdout — avoid running it where logs are public; (4) Inspect and run the scripts in an isolated environment first; (5) If you don't own the embedded appid, do not rely on or trust that account (it could be abused to collect drafts under that third-party account). If the author intended the config values to be placeholders, they should be clearly marked as such; absence of that clarification is the main reason this package is suspicious.

Type: OpenClaw Skill Name: wx-md-article Version: 1.0.0 The skill bundle contains hardcoded WeChat API credentials (appid and appsecret) in config.json, which is a significant security risk. Additionally, wechat-article.sh is highly vulnerable to Remote Code Execution (RCE) because it uses double-quoted strings within sed commands (e.g., sed "s/{{TITLE}}/$title/g") to process user-supplied arguments, allowing for shell command substitution. While these represent critical security flaws, they appear to be unintentional vulnerabilities rather than intentional malicious logic.