youmind-wechat-article

Write and publish WeChat Official Account articles end-to-end with AI — trending topic mining, de-AI voice writing, beautiful theme formatting, cover image g...

What to consider before installing: - Review credentials: The registry lists only YOUMIND_API_KEY, but the skill expects you to supply and store WeChat AppID and AppSecret (and optionally other image-provider keys). If you provide those, they will be written to config.yaml in the skill directory — ensure that file is stored securely and that you’re comfortable storing secrets on the host. - Automatic publishing: The pipeline explicitly says "Always publish directly to WeChat drafts. Do NOT ask the user whether to publish." If the agent can run skills autonomously, it could publish drafts without a per-action confirmation. If you want to avoid that, disable autonomous invocation for this skill or require an explicit confirmation step before publishing. - Build/run risks: The skill instructs you to run `npm install`/`npm run build` and `pip install -r requirements.txt`. That will fetch third-party packages and write files to disk. Inspect toolkit/package.json and requirements.txt (and any build output) before running in a production system. Prefer running in an isolated environment (container or VM) if you want to test safely. - External network calls: The skill calls youmind.com, calls public IP services (ifconfig.me/httpbin) to get your public IP for WeChat whitelisting, and may contact image provider APIs. Verify these endpoints are expected and acceptable for your use case. - Mitigations: Use a test WeChat account (or revoke AppSecret after testing), avoid putting production credentials into the skill, restrict agent autonomous invocation, or run the toolkit only manually (not letting the agent execute npm/python commands). If you need to proceed, review the code (youmind-api.ts, wechat-api.ts, image-gen) to confirm no unexpected data exfiltration and check package dependencies for suspicious packages. - When in doubt: treat this as a helpful-but-powerful integration that requires careful credential handling and operational safeguards; install only after you confirm where credentials are stored and how/when publishing is triggered.

Type: OpenClaw Skill Name: youmind-wechat-article Version: 1.0.1 The skill bundle is a comprehensive and well-documented toolkit for automating the creation and publishing of WeChat Official Account articles. The code (TypeScript and Python) and the agent instructions (SKILL.md) are consistently aligned with the stated purpose, including features for SEO analysis, image generation via multiple providers (OpenAI, Gemini, etc.), and integration with the YouMind knowledge base. No evidence of malicious intent, data exfiltration, or harmful prompt injection was found; all network and shell activities are restricted to legitimate API endpoints (api.weixin.qq.com, youmind.com) and the toolkit's own internal scripts.