Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Wechat Article Parser Local

v1.0.0

解析微信公众号文章,提取标题、作者、正文内容、图片等信息。当用户发送微信公众号链接(mp.weixin.qq.com)并希望获取文章内容、摘要或保存时触发。支持自动提取内容并可选保存到飞书表格。

0· 25·1 current·1 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Pending
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description match the included code: scripts/wechat_parser.py parses mp.weixin.qq.com articles and scripts/save_to_feishu.py saves to Feishu. However the code calls an external 'openclaw' CLI (openclaw web-fetch) as a primary extraction path — this binary is not declared in the skill's required binaries or install instructions, which is an omission and a capability mismatch.
!
Instruction Scope
SKILL.md and READMEs instruct running the two scripts and document .env variables for Feishu. The save_to_feishu.py script performs extra actions not emphasized in SKILL.md: it will auto-create missing fields in the target table and will search and batch-delete blank records. Those modifying/deleting actions are within the Feishu scope but are potentially destructive and are not clearly highlighted in the summary documentation presented to the registry.
Install Mechanism
No install spec (instruction-only) and Python dependencies are reasonable (requests, bs4, python-dotenv). No external downloads. The use of subprocess to invoke a local 'openclaw' CLI is a hidden dependency (not declared), which means the agent will try to execute an arbitrary binary if present — this should be declared and justified.
!
Credentials
The scripts read FEISHU_* credentials from a .env file and environment variables (FEISHU_APP_ID, FEISHU_APP_SECRET, FEISHU_APP_TOKEN, FEISHU_TABLE_ID). Those env vars are appropriate for the Feishu save feature, but the registry metadata lists no required env vars — an inconsistency. Also the Feishu tokens grant read/write/delete access to a user table, so users should ensure they provide least-privilege credentials and target a test/isolated table.
Persistence & Privilege
The skill does not request always:true and does not modify other skills. However save_to_feishu.py will perform stateful operations on the user's Feishu table (create fields, batch-delete empty rows), which is a privileged action against the user's external data source and worth noting before enabling the skill.
What to consider before installing
This skill appears to implement WeChat article parsing and optional saving to Feishu, but there are a few things to check before installation: - The registry metadata does not declare required environment variables, but the code expects FEISHU_APP_ID, FEISHU_APP_SECRET, FEISHU_APP_TOKEN, and FEISHU_TABLE_ID in a .env or environment — provide these only if you trust the skill and use a dedicated Feishu app/table. - save_to_feishu.py will automatically create missing fields in the target table and batch-delete blank rows. Back up or use a test table to avoid accidental data loss. - The save script attempts to call a local 'openclaw' CLI (openclaw web-fetch) via subprocess as its primary extraction path. If that binary exists on your system it will be executed; ensure you trust that binary or remove/inspect that code path if you do not want arbitrary local executables invoked. - If you plan to enable the Feishu save feature, create a Feishu app with minimal required permissions and test with a non-production table first. What would raise confidence to high: the registry metadata listing the FEISHU env vars and declaring the openclaw CLI as a required binary (or removing that dependency), and confirmation from the author that automatic deletion behavior is intentional and documented. If you want, I can point out the exact lines in save_to_feishu.py that create fields and delete records so you can review/modify them before use.

Like a lobster shell, security has layers — review code before you run it.

latestvk97dx2d0h67zdchzx87d93pc9s847xbw

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Comments