公众号草稿 / 发布(微信 API)

• Risk level: Low
• Analyzed: Apr 22, 2026, 11:24 PM
• Findings: 0
• Version: 1.0.22

Overview

The skill's code, instructions, and requested environment access are consistent with its stated purpose (publishing WeChat articles via the official API); nothing requests unrelated credentials or surprising install sources.

This skill appears to do exactly what it says: it reads article files and a local aws.env containing your WeChat AppID/AppSecret and calls the WeChat API to upload images and create/submit drafts. Before installing or running: (1) store aws.env securely (do not commit real secrets to git), (2) run first in publish_method: draft mode to verify behavior, (3) confirm WECHAT_N_API_BASE is not pointed to an unexpected host (it may be customized to a proxy), (4) run the scripts in a controlled environment with PyYAML/Pillow installed as needed, and (5) review aws.env and .aws-article/config.yaml contents if you plan to use multiple accounts. If any of the above seems unexpected for your use case, inspect the scripts in this package and test with non-production credentials first.