Zhy Markdown2wechat

Use when converting Markdown into WeChat-compatible inline HTML with theme styles for preview, copy-paste, or downstream draft publishing.

This skill is generally coherent with its purpose, but take these precautions before installing or running it: - Ensure Node.js is available where the agent will run (SKILL.md requires node but registry metadata omitted it). - The included script will run `npm install` at runtime to fetch marked@4 and juice@8 into a temporary folder; this performs network downloads from the npm registry (supply-chain risk). If you prefer, pre-install the dependencies in a controlled environment to avoid runtime network installs. - The script creates a .wechat-temp directory in the current working directory and attempts to remove it; run it in a workspace where that is acceptable and where npm can run. - Review the two packages (marked, juice) versions used so you are comfortable with them, and consider running the script locally first to verify behavior. - If you allow autonomous agent invocation, consider requiring explicit user confirmation before executing the conversion command to avoid unexpected execution.

Type: OpenClaw Skill Name: zhy-markdown2wechat Version: 0.1.0 The skill converts Markdown to WeChat-compatible HTML using a Node.js script (scripts/convert.js) that dynamically installs dependencies (marked, juice) via 'npm install' at runtime. While this supports the stated 'zero deployment' goal, the use of child_process.execSync and the lack of input sanitization on file path arguments (mdPath, cssPath, outPath) present risks for command injection and path traversal. These behaviors appear to be risky implementation choices rather than intentional malware, but the automated execution of shell commands and dynamic package fetching warrants a suspicious classification.