朋友圈文案生成器

PassAudited by VirusTotal on May 6, 2026.

Overview

Type: OpenClaw Skill Name: wechat-copywriter Version: 1.0.0 The skill is a legitimate WeChat marketing copy generator that uses the DeepSeek AI API. The code in generate.js follows standard practices for retrieving API keys from environment variables or local configuration files (~/.openclaw/openclaw.json) and communicates only with the official api.deepseek.com endpoint. No evidence of data exfiltration, malicious execution, or prompt injection was found.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

It may be harder to verify who maintains the skill or compare the installed code against an upstream source.

Why it was flagged

The artifacts provide no source repository or homepage, which limits provenance context for a skill that includes executable JavaScript.

Skill content
Source: unknown; Homepage: none
Recommendation

Install only if you trust the registry/publisher, and review the small included code before use.

What this means

Using the skill may consume your DeepSeek account quota or billing and relies on a locally stored API key.

Why it was flagged

The skill reads a DeepSeek API key from the environment or local OpenClaw configuration before making its API request. This is purpose-aligned, but it uses a credentialed provider account.

Skill content
let API_KEY = process.env.DEEPSEEK_API_KEY || ''; ... '.openclaw/openclaw.json' ... config.models?.providers?.deepseek?.apiKey
Recommendation

Use it only if you intend to use DeepSeek for generation, and verify that the API key has appropriate scope and billing limits.

What this means

Product names, campaign details, or other text you enter may be sent to DeepSeek.

Why it was flagged

The skill sends the generated prompt, including the user-provided product and style details, to DeepSeek's external chat-completions API.

Skill content
hostname: 'api.deepseek.com', path: '/v1/chat/completions' ... { role: 'user', content: prompt }
Recommendation

Avoid entering confidential customer data, trade secrets, or unreleased business details unless you are comfortable sharing them with DeepSeek.