v1.0.0

微信公众号文章阅读器

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 7:28 AM.

Analysis

This appears to be a simple WeChat article reader; the main things to notice are that it makes outbound web requests and asks for manually installed Python dependencies.

GuidanceBefore installing, understand that this skill will contact article URLs over the network and may need httpx and beautifulsoup4 installed. Use it only for WeChat article links you intend to read, and install dependencies in a trusted Python environment.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Tool Misuse and Exploitation

SeverityLowConfidenceHighStatusNote

weixin_reader.py

with httpx.Client(follow_redirects=True, timeout=30) as client:
            resp = client.get(url, headers=headers)

The script makes an outbound request to whatever URL is passed and follows redirects. This is expected for a URL reader, but the code does not enforce the documented mp.weixin.qq.com scope.

User impactIf misused with a non-WeChat or malicious URL, the skill could contact unintended websites from the user's environment.

RecommendationUse it only with intended WeChat article links, or add domain validation for mp.weixin.qq.com before making the request.

Agentic Supply Chain Vulnerabilities

SeverityInfoConfidenceHighStatusNote

SKILL.md

如未安装，运行：
```bash
pip install httpx beautifulsoup4
```

The skill relies on manually installed, unpinned Python packages. This is purpose-aligned, but package versions and install source are left to the user's environment.

User impactInstalling dependencies may modify the local Python environment and relies on the package source being trustworthy.

RecommendationInstall dependencies from a trusted package index, preferably in a virtual environment, and consider pinning known-good versions.