Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
微信公众号自定义主题应用工具
v1.0.0AI-ready skill to test, register, and publish Markdown articles to WeChat Official Accounts using a local custom CSS theme via Wenyan CLI.
⭐ 0· 46·0 current·0 all-time
byLei@caol64
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The SKILL.md describes exactly the expected capabilities (render locally, publish to WeChat drafts, register themes) and these require WECHAT_APP_ID / WECHAT_APP_SECRET and a wenyan-cli installation — so functionality itself is coherent. However, the registry metadata lists no required environment variables or primary credential, which is inconsistent with the skill's stated runtime requirements and could hide sensitive credential needs from users.
Instruction Scope
Instructions are narrowly scoped to running the wenyan-cli commands (wenyan render / publish / theme --add) against local Markdown and CSS files and checking for expected HTML output. The steps do not instruct the agent to read unrelated files or exfiltrate data to third-party endpoints outside the described publishing flow. They do, however, mandate using WeChat credentials to call the WeChat service via the CLI.
Install Mechanism
This is an instruction-only skill with no install spec or code files, which lowers disk/write risk. The SKILL.md requires the external tool wenyan-cli (suggesting pnpm install), but the skill does not itself provide or fetch that binary—users should verify the cli's provenance before installing it.
Credentials
The SKILL.md requires sensitive environment variables (WECHAT_APP_ID and WECHAT_APP_SECRET), which are proportionate to the publish capability. The problem is the registry metadata did not declare these required credentials or a primaryEnv, meaning users might not be warned by the platform about sensitive data the skill needs. That mismatch increases the risk of credentials being supplied without clear consent/context.
Persistence & Privilege
always is false and autonomous invocation is default (not flagged alone). The skill's 'theme --add' action will persist a theme into the local wenyan-cli theme library (a local config change), which is reasonable for its purpose but should be noted as modifying local CLI state.
What to consider before installing
This skill appears to do what it says (render, publish to WeChat drafts, and register local themes) but the SKILL.md requires WECHAT_APP_ID and WECHAT_APP_SECRET while the registry metadata does not declare them — that mismatch is the main concern. Before installing or using it: 1) Confirm you trust the wenyan-cli package source (review its project/homepage and code if possible). 2) Only provide WeChat credentials in a secure way and understand the scope (publishing drafts). 3) Prefer to run the render step locally yourself first; avoid allowing the agent to autonomously publish without your explicit approval. 4) Ask the publisher to update registry metadata to declare required env vars so the platform can surface the credential requirement to you. If you need higher assurance, request an install spec or source link to inspect the wenyan-cli behavior that performs the network calls.Like a lobster shell, security has layers — review code before you run it.
latestvk974m4kebkaf57wftc3jst083d84fan4
License
MIT-0
Free to use, modify, and redistribute. No attribution required.