Security audit
Security checks across malware telemetry and agentic risk
This is a disclosed WeChat publishing tool, but it deserves review because it can publish or delete WeChat account content and fetch/upload arbitrary URLs without strong safeguards.
Install only if you are comfortable giving the skill WeChat Official Account credentials and letting it create drafts, upload images, publish articles, and delete drafts when invoked. Use --dry-run first, verify the selected account and media_id before publishing or deleting, avoid untrusted article/image URLs, and keep config.json out of shared repositories.
req = Path(__file__).resolve().parent / "requirements.txt"
if not req.exists():
raise RuntimeError(f"未找到依赖文件: {req}")
subprocess.check_call([sys.executable, "-m", "pip", "install", "-r", str(req)])
def slugify(text: str) -> str:return media_id
def upload_image_from_url(self, token: str, image_url: str) -> str:
img = requests.get(image_url, timeout=self.timeout)
img.raise_for_status()
content_type = img.headers.get("Content-Type", "image/jpeg")
if not content_type.startswith("image/"):return image_url
def upload_content_image_from_url(self, token: str, image_url: str) -> str:
img = requests.get(image_url, timeout=self.timeout)
img.raise_for_status()
content_type = img.headers.get("Content-Type", "image/jpeg")
if not content_type.startswith("image/"):requests>=2.31.0 beautifulsoup4>=4.12.0 markdown>=3.5.0 pyyaml>=6.0.0
requests>=2.31.0 beautifulsoup4>=4.12.0 markdown>=3.5.0 pyyaml>=6.0.0 Pillow>=10.0.0
requests>=2.31.0 beautifulsoup4>=4.12.0 markdown>=3.5.0 pyyaml>=6.0.0 Pillow>=10.0.0
requests>=2.31.0 beautifulsoup4>=4.12.0 markdown>=3.5.0 pyyaml>=6.0.0 Pillow>=10.0.0
beautifulsoup4>=4.12.0 markdown>=3.5.0 pyyaml>=6.0.0 Pillow>=10.0.0
67/67 vendors flagged this skill as clean.
No suspicious patterns detected.