wx-mp-push

This skill appears to implement the advertised WeChat article-publishing features, but proceed with caution: 1) It expects you to put AppID/AppSecret into config.json — keep that file private and do not check it into source control. 2) The publish script will scan article HTML for <img src="..."> and will open local files (relative or absolute) and upload them to WeChat; if the HTML contains paths to sensitive files (e.g., /etc/… or other local secrets) those files could be read and sent to an external service. Don't run this on machines containing sensitive data unless you inspect the code and control the content it processes. 3) Documentation has contradictions about handling external URLs — verify whether external remote images are fetched and re-uploaded. 4) Review the script (publish_article.py) yourself, run it in an isolated environment (or with a test account) first, and restrict where config.json and the token cache are stored. If you want a safer setup, provide only sanitized content (no absolute paths), or run the tool in a container with limited filesystem visibility and network access. If you want, I can point out specific lines in publish_article.py that perform file reads and uploads so you can inspect them more closely.