Security audit
Security checks across malware telemetry and agentic risk
This skill is a WeChat content workflow, but it includes automatic account publishing, exposed credential examples, and proxy/account-management code that users should review carefully before installing.
Install only if you intentionally want an agent to use your search, GLM, and WeChat Official Account credentials and to send generated content/media to WeChat. Before use, remove or rotate the hardcoded/example-looking WeChat secrets, avoid printing keys, disable automatic publishing unless you add an explicit approval step, and do not configure WECHAT_PROXY_URL to any endpoint you do not fully control.
"""
try:
print(f"📥 Downloading image to: {output_path}")
response = requests.get(image_url, timeout=30)
response.raise_for_status()
# Create output directory if needed}
try:
response = requests.get(TOKEN_URL, params=params, headers=self._proxy_headers, timeout=10)
response.raise_for_status()
data = response.json()json_data = json.dumps(payload, ensure_ascii=False).encode('utf-8')
headers = {'Content-Type': 'application/json; charset=utf-8'}
headers.update(self._proxy_headers)
response = requests.post(url, data=json_data, headers=headers, timeout=30)
response.raise_for_status()
data = response.json()}
try:
response = requests.post(url, json=payload, headers=self._proxy_headers, timeout=30)
response.raise_for_status()
data = response.json()try:
with open(image_path, 'rb') as f:
files = {'media': (image_path.name, f, 'image/png')}
response = requests.post(url, files=files, headers=self._proxy_headers, timeout=60)
response.raise_for_status()
data = response.json()try:
with open(image_path, 'rb') as f:
files = {'media': (image_path.name, f, 'image/png')}
response = requests.post(url, files=files, headers=self._proxy_headers, timeout=60)
response.raise_for_status()
data = response.json()67/67 vendors flagged this skill as clean.
No suspicious patterns detected.