ClawHub

WeChat to Obsidian

v1.0.0

Clip WeChat public articles (mp.weixin.qq.com) to Obsidian vault — headless browser, full text + images in original order, no broken links. 将微信公众号文章无损剪藏到 Obs...

⭐ 0· 135·0 current·0 all-time
by@dw1161
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
medium confidence
✓
Purpose & Capability
Name/description, required binaries (agent-browser, curl), and the instructions all align: a headless browser is needed to render WeChat pages and curl is needed to download images. Nothing requested is outside the scope of clipping articles.
ℹ
Instruction Scope
SKILL.md instructs the agent to open arbitrary mp.weixin.qq.com URLs, run page-eval JS to extract DOM content, download images with curl using a Referer header, and write files into a local Obsidian vault. These actions are expected for this task, but they do involve filesystem writes and fetching external binary content (images). The skill does state to always ask the user before writing, which is good practice.
ℹ
Install Mechanism
Install uses an npm package named 'agent-browser' to provide the headless browser binary. This is proportionate to the need for a headless browser, but npm installs can execute arbitrary code (install scripts). The package has no linked homepage/source in the registry metadata provided, increasing provenance risk.
✓
Credentials
No environment variables, credentials, or config paths are requested. The lack of secrets or unrelated credentials is appropriate for this local clipping function.
✓
Persistence & Privilege
Skill does not request always:true, does not claim permanent elevated privileges, and will only act when invoked. It writes files to locations chosen/confirmed by the user (per instructions), so persistence/privilege requests are proportional.
Assessment
This skill's behavior matches its description, but exercise caution before installing: (1) verify the provenance of the 'agent-browser' npm package (review its npm page, maintainer, and source repository) because npm packages can run code during install; (2) prefer installing the agent-browser binary yourself and confirm its version before granting the skill permission to write into your Obsidian vault; (3) the skill will download external images—be mindful of copyright and possible tracking URLs; (4) only allow the skill to write after you confirm the target folder each time (the SKILL.md recommends this); and (5) if you lack confidence in the package origin, run installs in an isolated environment or decline installation.

Like a lobster shell, security has layers — review code before you run it.

latestvk97a75e9rdk2jnghdjaz1sgms983bq36

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

Binsagent-browser, curl

Install

Install agent-browser (headless browser CLI)
Bins: agent-browser
npm i -g agent-browser

Comments