WeChat RSS
Analysis
This skill appears to do what it says—fetch WeChat RSS articles through wcrss.com—but users should notice that it uses an API key, sends requests to that service, summarizes external article content, and writes a local cache.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
For each article, use the LLM to summarize the `content_html` into key points
Fetched article HTML is placed into the LLM context. This is necessary for summarization, but external article text could contain instructions that should not be followed as agent commands.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
api_key = os.environ.get("WCRSS_API_KEY")The script requires a wcrss.com API key from the environment and sends it as a Bearer token to the wcrss API; this is purpose-aligned, but it is still credential use.
Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.
CACHE_FILE = "wechat_articles_cache.json"
The script writes fetched articles and publisher data to a local JSON cache that later commands read back for article retrieval.