Security audit
Security checks for vulnerabilities and agentic risk
The skill is a narrow browser workflow for creating a WeChat Official Account article collection, with some operational cautions but no evidence of hidden, destructive, or exfiltrating behavior.
Install only if you want an agent to operate an authenticated WeChat Official Account browser session and create a real article collection. Confirm the collection name and account context before invoking it, and prefer the documented OpenClaw browser profile rather than a personal browser profile.
The skill performs a live publishing action in the user's WeChat official account by clicking the final '发布' button, but it does not clearly require an explicit confirmation immediately before the irreversible account action. In an automation context, this can cause unintended content creation in a production account, especially if the user expected a draft-only workflow.
The instructions repeatedly use URLs with lang=zh_CN, which indicates a forced locale choice in the skill behavior. The file does not offer the user a language/locale option or explain that the skill is intentionally limited to a China-region or Chinese-interface workflow.
Earlier instructions require starting the browser with browser(action=start, target="host", profile="openclaw") and emphasize that openclaw is distinct from user (L052-L059). But L124 says the browser should first be started with browser(action=start, profile=user), which conflicts with the documented procedure and could cause the agent to use the wrong browser context.
No suspicious patterns detected.
