Content Factory 内容工厂

Key things to check before installing or running this skill: 1) Metadata mismatch: The registry claims no env vars/binaries required, but the skill requires yt-dlp (or equivalent), a GLM API key (GLM_API_KEY) for cover generation, and optionally WeChat credentials (WECHAT_APP_ID, WECHAT_APP_SECRET) to auto-publish. Ask the publisher why those were not declared. 2) Sensitive credentials: Inspect .env.example and any committed files for hardcoded or example credentials. Notably, create_default_cover.py contains APPID/APPSECRET values and will write them into wechat_config.py after uploading — remove or replace hardcoded credentials and do not publish them. Only provide your WeChat credentials if you trust the code and the publisher. 3) Network behavior: The scripts will call open.bigmodel.cn (image generation), api.weixin.qq.com (upload/publish), and run yt-dlp (downloads from YouTube). If you only want drafts, avoid running the publish/upload scripts or run in a network-restricted sandbox. 4) Local execution risk: There is no install sandbox; the package includes runnable Python scripts. Run check_env.py first to see what the skill expects. Consider running everything in a disposable VM or container and inspect outputs before giving real credentials. 5) Ask the author / request changes: a) update registry metadata to list required binaries and env vars; b) remove hardcoded credentials from scripts; c) document exactly what network endpoints are contacted and when; d) add explicit user consent steps before any publishing/uploading to external services. If you decide to proceed, test with dummy API keys and sandbox accounts, and rotate any real keys after initial testing.