Security audit
Security checks across malware telemetry and agentic risk
This WeChat article skill is mostly purpose-related, but it also handles credentials and automatic publishing in ways users should review carefully before installing.
Install only if you intend to let this skill handle WeChat publishing. Before use, remove or rotate any real exposed credentials, avoid running commands that print API keys, restrict WECHAT_PROXY_URL to a trusted endpoint or disable it, review every file before upload, and require explicit approval before any WeChat draft or freepublish action.
}
try:
response = requests.get(TOKEN_URL, params=params, headers=self._proxy_headers, timeout=10)
response.raise_for_status()
data = response.json()json_data = json.dumps(payload, ensure_ascii=False).encode('utf-8')
headers = {'Content-Type': 'application/json; charset=utf-8'}
headers.update(self._proxy_headers)
response = requests.post(url, data=json_data, headers=headers, timeout=30)
response.raise_for_status()
data = response.json()}
try:
response = requests.post(url, json=payload, headers=self._proxy_headers, timeout=30)
response.raise_for_status()
data = response.json()try:
with open(image_path, 'rb') as f:
files = {'media': (image_path.name, f, 'image/png')}
response = requests.post(url, files=files, headers=self._proxy_headers, timeout=60)
response.raise_for_status()
data = response.json()try:
with open(image_path, 'rb') as f:
files = {'media': (image_path.name, f, 'image/png')}
response = requests.post(url, files=files, headers=self._proxy_headers, timeout=60)
response.raise_for_status()
data = response.json()65/65 vendors flagged this skill as clean.
Detected: suspicious.exposed_secret_literal