Baoyu Post To Wechat

v1.103.2

Posts content to WeChat Official Account (微信公众号) via API or Chrome CDP. Supports article posting (文章) with HTML, markdown, or plain text input, and image-tex...

⭐ 0· 2k·58 current·58 all-time

byJim Liu 宝玉@jimliu

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for jimliu/baoyu-post-to-wechat.

Previewing Install & Setup.

Prompt PreviewInstall & Setup

Install the skill "Baoyu Post To Wechat" (jimliu/baoyu-post-to-wechat) from ClawHub.
Skill page: https://clawhub.ai/jimliu/baoyu-post-to-wechat
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install baoyu-post-to-wechat

ClawHub CLI

Package manager switcher

npx clawhub@latest install baoyu-post-to-wechat

Security Scan

Capability signals

Requires OAuth tokenRequires sensitive credentials

These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.

VirusTotal

Benign

View report →

OpenClaw

Suspicious

high confidence

Purpose & Capability

Name/description match the included scripts: the bundle contains browser CDP scripts, markdown→HTML conversion, clipboard helpers and an API poster. However the registry metadata declares no required environment variables or config paths and no primary credential while the runtime clearly expects WeChat API credentials (WECHAT_APP_ID / WECHAT_APP_SECRET), per-account prefixed variants, and Chrome profile paths. That mismatch is incoherent: a posting skill legitimately needs those credentials and config paths but the metadata omits them.

ℹ

Instruction Scope

SKILL.md and the reference docs instruct the agent to run local scripts (via bun/npx), open/launch Chrome, simulate keystrokes/paste, read and write EXTEND.md and .baoyu-skills/.env, and read files the user points to (markdown, images). Those actions are within the declared functional scope (posting via API or browser), but they include operations with broad side effects (creating config files in the user home, manipulating Chrome profiles, requiring Accessibility/clipboard privileges) that callers should be aware of.

✓

Install Mechanism

There is no external download URL or installer; this is an instruction-first skill that runs included TypeScript scripts via bun/npx. That lowers supply-chain risk compared to downloading remote archives. The bundle includes a bun.lock and many dependencies, which is expected given image processing and CDP interactions.

Credentials

Registry metadata lists no required env vars, but the runtime and docs expect/use multiple env vars and config files: WECHAT_APP_ID/WECHAT_APP_SECRET (and per-account prefixed variants like WECHAT_{ALIAS}_APP_ID), WECHAT_BROWSER_CHROME_PATH, BAOYU_CHROME_PROFILE_DIR / chrome_profile_path in EXTEND.md, and .baoyu-skills/.env in cwd or home. The skill also writes credentials to ~/.baoyu-skills/.env or project .baoyu-skills/.env during guided setup. Declaring none of these in metadata is a mismatch and risks surprise credential storage/exposure.

ℹ

Persistence & Privilege

always:false (no forced inclusion) and autonomous invocation is allowed (default). The skill will create/modify files under .baoyu-skills and may create isolated Chrome profile dirs; it does not request elevated OS privileges beyond normal clipboard/Accessibility usage. This level of persistence (writing user config and profiles) is typical for such tooling but is notable and should be accepted explicitly by users.

What to consider before installing

This skill appears to implement WeChat posting workflows (API and browser automation) and includes all the tooling to do so, but the registry metadata understates what it will access and store. Things to consider before installing or using it: - Credentials: The scripts expect WECHAT_APP_ID and WECHAT_APP_SECRET (and optional per-account prefixed env vars). The guided setup will ask for these and append them in plain text to .baoyu-skills/.env (project or ~/.baoyu-skills/.env). Only supply AppID/Secret you trust to be stored unencrypted on disk, and prefer per-account keys rather than a shared high‑privilege key. - Config & files: The skill will read/write EXTEND.md and .baoyu-skills/.env in your project or home directory and may create Chrome profile directories. If you want isolation, review/choose the profile path before running and do not reuse your primary Chrome profile. - OS interactions: The browser automation simulates keystrokes and pastes images from the clipboard, and the permission checker uses system tools (osascript/swift/xdotool/wl-copy/powershell). You will likely need to grant Accessibility/clipboard permissions on macOS and install helper tools on Linux. The scripts may invoke swift/powershell or system clipboard utilities—confirm those commands are acceptable in your environment. - Metadata mismatch: The package metadata does not declare the env vars and config paths the code uses. That is an incoherence — treat the runtime docs as the source of truth and inspect the code (especially scripts/wechat-api.ts) for network endpoints and behavior before use. - Safety steps: Run scripts in a safe/test environment first, review the code for wechat-api.ts (to confirm it calls the official WeChat endpoints), use temporary or limited-scope WeChat credentials, and run the provided check-permissions script to see what the skill will require. If you have any doubt, do not store highly sensitive credentials in the unencrypted .baoyu-skills/.env files and consider running this tool inside an isolated account or VM.

✗

scripts/cdp.ts:51