by 安全扫描
OpenClaw
安全
high confidenceThe skill's code, instructions, and required files are consistent with a WeChat multi-account article styling/publishing tool; nothing suggests it is doing unrelated or hidden actions.
评估建议
This skill appears to do what it claims, but take these precautions before use:
- Protect your WeChat credentials: the scripts expect appId/appSecret in a JSON config file (config.example provided). Store that file securely and avoid committing it to VCS.
- The skill writes token cache and template registry files to disk (tokenCacheDir, registry paths). Be aware where those files live and restrict access.
- The import tools fetch arbitrary article URLs (or read local HTML) when you ask; only imp...详细分析 ▾
✓ 用途与能力
Name/description match the actual code and scripts: the package provides Node/Python scripts to apply styles, import templates from article HTML/URLs, manage a config, and publish drafts to the WeChat API. The use of appId/appSecret in the provided config is expected for WeChat publishing.
✓ 指令范围
SKILL.md directs running included scripts and references only the package files, a config JSON, template files, and user-supplied article HTML/URLs. The importers explicitly strip <script> tags and the publishing paths call only api.weixin.qq.com. Scripts read/write local config/registry/token-cache files and fetch remote article HTML when asked — all within the stated feature set.
✓ 安装机制
There is no install spec (instruction-only skill) and all code is bundled in the skill. No external download URLs or extract steps are used. Dependencies are standard (juice, highlight.js for Node; httpx for Python) and are declared in package.json/requirements.txt.
ℹ 凭证需求
The skill metadata declares no required env vars or primary credential, but the tool expects WeChat credentials (appId/appSecret) to be stored in a JSON config (assets/config.example.json). This is reasonable for the purpose, but it is a mismatch between metadata and actual credential storage: credentials are handled via config files rather than environment variables. The scripts write token caches and template registries to disk (config.wechat.tokenCacheDir and template registry paths).
✓ 持久化与权限
always:false and user-invocable default are appropriate. The skill writes only to its own config/registry/token-cache files and does not modify other skills or system-wide agent settings.
⚠ scripts/import-template-node.mjs:130
File read combined with network send (possible exfiltration).
⚠ scripts/publish-node.mjs:53
File read combined with network send (possible exfiltration).
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/12
wechat-style-publisher v1.0.0 – Initial release - Enables publishing styled articles to one or more WeChat Official Accounts with independent account credentials. - Supports topic-based HTML themes, custom CSS overrides, and intro/outro HTML templates per article. - Allows importing templates and layouts from existing WeChat articles (via URL or HTML file). - Provides both Node.js and Python scripts for publishing and template importing. - Automates local image and cover uploads, CSS inlining (Node.js), and flexible configuration management.
● 无害
安装命令
点击复制官方npx clawhub@latest install wechat-style-publisher
镜像加速npx clawhub@latest install wechat-style-publisher --registry https://cn.longxiaskill.com 镜像可用
本土化适配说明
wechat-style-publisher — 技能工具 安装说明： 安装命令：npx clawhub@latest install wechat-style-publisher 该技能用于微信相关操作，可能需要相应的平台账号或API密钥
技能文档
当任务是将一篇文章发布到一个或多个微信公众号，并需要使用账号独立凭据、主题化 HTML、以及可选的开头/结尾引导模板时，请使用此技能。
主要入口
- Node.js 发布脚本：
{baseDir}/scripts/publish-node.mjs - Python 发布脚本：
{baseDir}/scripts/publish-python.py - 仅应用样式（Node.js）：
{baseDir}/scripts/apply-style.mjs - 模板导入工具：
{baseDir}/scripts/import-template-node.mjs
- {baseDir}/scripts/import-template-python.py
- 配置编辑器：
{baseDir}/scripts/set-config.mjs
# 功能说明
- 将草稿文章发布到一个或多个已配置的微信公众号
- 支持通过 账号 ID 列表 或 所有已启用账号进行发布
- 支持内置主题以及自定义 CSS 覆盖
- 在文章正文前后自动插入 intro / outro HTML 模板
- 上传文章中的本地图片以及可选的封面图片
- 在 Node.js 流程中自动 内联 CSS 以兼容微信公众号
- 可从现有微信公众号文章 HTML 文件或文章 URL 中导入 intro/outro 模板和文章布局样式
- 将提取出的模板存储为 命名变量，方便后续复用
- 发布配置优先读取
wechat.accounts..publishing
若不存在则回退到顶层 publishing
- 支持兼容参数别名，例如
--article-url、--link、--template-name、--template-registry
- 支持
--extract-mode ai
# 输入内容
- HTML 内容
- 多账号配置 JSON
{baseDir}/assets/config.example.json- 可选的文章开头/结尾模板