📦 Wechat Article — 技能工具
v1.0.0微信公众号创作技能，按照傅盛写作风格指南创作口语化、故事感、有态度的文章
0· 57·0 当前·0 累计
by 安全扫描
OpenClaw
可疑
medium confidenceThe skill is mostly an instruction-only WeChat article writer, but its runtime instructions reference external scripts and a publishing tool (not declared) and require executing files outside the skill, which is disproportionate and unclear.
评估建议
This skill is primarily a writing template, which is fine, but the instructions try to run an external image-generation script at /usr/lib/node_modules/openclaw/skills/nano-banana-pro/scripts/generate_image.py and to publish via 'wechat-mp-toolkit' without declaring any credentials. Before installing or running it: 1) Verify whether that generate_image.py exists on your system and inspect its contents — do not run it until you trust it. 2) Confirm where the 'writing style guide' is stored (local...详细分析 ▾
⚠ 用途与能力
The skill's stated purpose (write WeChat public-account articles in a specific style) is straightforward and would not normally require running system scripts or external publishing tooling. However, the SKILL.md explicitly calls a script at /usr/lib/node_modules/openclaw/skills/nano-banana-pro/scripts/generate_image.py and references 'wechat-mp-toolkit' for publishing — capabilities that are not explained or declared in the skill metadata.
⚠ 指令范围
Instructions direct the agent to run an external image-generation script at a hard-coded system path and to use an external publishing tool. The skill also says to 'read the writing style guide' without specifying where—potentially implying reading files or system state not contained in the skill. These steps expand the runtime scope beyond simple text-generation and grant the agent discretion to execute arbitrary local scripts.
ℹ 安装机制
There is no install spec (instruction-only), which limits installation risk. However, the SKILL.md references a script in /usr/lib/node_modules/... (another skill's install path). That reference implies reliance on files installed elsewhere; if that path is present, the skill expects to execute code from it, which raises risk even though this skill does not itself install anything.
⚠ 凭证需求
No environment variables or credentials are declared, but the publishing step ('使用 wechat-mp-toolkit 发布') would normally require credentials or tokens. The absence of declared env vars/credentials is inconsistent with the publish action. Additionally, invoking a script in another skill's node_modules path could access other configs or secrets on the system.
✓ 持久化与权限
The skill does not request 'always: true' and has no install-time changes declared. It is user-invocable and allows normal autonomous invocation (platform default). There is no evidence the skill modifies other skills' configs or requests persistent elevated privileges.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/2
wechat-article 1.0.0 初始发布 - 提供微信公众号写作技能，基于傅盛写作风格指南 - 支持口语化、故事感、有态度的文章创作 - 提供标题策略和内容结构建议 - 包含适合公众号的排版与配图规则 - 指导生成封面图及标准发布流程
● 无害
安装命令
点击复制官方npx clawhub@latest install dongrebeccahhh-wechat-article
镜像加速npx clawhub@latest install dongrebeccahhh-wechat-article --registry https://cn.longxiaskill.com