Wechat Mp Toolkit

微信公众号完整工具包，包括文章创作、封面生成、自动发布、热点分析等功能。适用于公众号运营者。

Security Scan

The skill mostly does what a WeChat publishing toolkit claims, but there are several mismatches and risky choices (hardcoded credentials, absolute root paths, executing other-skill scripts, missing referenced files, and a prompt-injection signal) that don't align with its declared requirements.

Purpose & Capability

Name/description match a WeChat publishing tool, and the code calls the WeChat API as expected. However the repo contains hardcoded appID/appSecret values in config/config.json and in scripts (which is unexpected when requires.env lists no credentials). SKILL.md references many scripts (create-article.js, generate-cover.js, publish-article.js, hotspot-analyzer.js, schedule-publish.js, batch-publish.js, stats.js) that are not present in the file list — only full-workflow.js and publish-existing.js exist. SKILL.md instructs editing config/wechat-config.json but the repo uses config/config.json. These mismatches reduce coherence between stated purpose and the actual bundle.

Instruction Scope

SKILL.md instructs network calls to news sources and to api.weixin.qq.com (expected) and to install ImageMagick (expected). But runtime instructions and scripts reference system/global paths (/root/.openclaw/..., /root/.openclaw/workspace-operator/skills/wechat-cover-generator/...) and execute an external cover script if present. The code writes/reads files under /root and /tmp, runs shell commands (execSync) and 'convert' — actions that reach outside the skill's own directory and can execute arbitrary code. SKILL.md also contains unicode-control-chars prompt-injection signals (scanner flagged this). The SKILL.md is vague about which files/credentials must be set and gives broad instructions, granting the agent substantial discretion.

Install Mechanism

There is no install spec (instruction-only install), and dependencies are standard Node packages (axios/form-data). That is low-risk in itself. However the shipped package includes runnable JS scripts and a package-lock.json; since there is no installation sandbox, running the supplied scripts will execute code from the repo on the host.

Credentials

The skill declares no required env vars or primary credential, yet the repo embeds appID/appSecret in config/config.json and duplicates them in scripts — this is disproportionate and risky. The presence of apparently real credentials in repo files (and absolute paths pointing to /root) is a red flag: credentials should be supplied via environment or a secure config, not hardcoded. SKILL.md suggests editing a different config filename than exists, so there is also confusion about where secrets should live.

Persistence & Privilege

always:false (good). But the code writes to and executes from absolute root-owned paths (/root/.openclaw/...), calls other-skill locations, and uses execSync to run external scripts and binaries. Combined with autonomous invocation being allowed by default, these behaviors increase blast radius if the skill is run automatically. The skill does not appear to modify other skills' configs directly, but it intentionally references them which is a privilege/scope creep.

Scan Findings in Context

[unicode-control-chars] unexpected: Pre-scan flagged unicode-control-chars in SKILL.md. The skill includes emoji and could contain control unicode that may be used for prompt manipulation; this is not expected for a standard README/SKILL doc and warrants manual review.

What to consider before installing

Do not run these scripts on a production host without review. Specific actions to consider before installing or executing: 1) Treat the embedded appID/appSecret in config/config.json and scripts as secrets that may be leaked — do not use them. Replace with your own credentials stored securely (environment variables or a secure config) and remove any hardcoded secrets. 2) Audit the two provided JS scripts line-by-line (or run them in an isolated VM/container) — they execute shell commands, run external scripts by absolute path, write under /root, and call other skill locations; all of which can execute untrusted code. 3) Fix mismatches: SKILL.md references many scripts that are missing and mentions a different config filename; ask the author for a complete, consistent release. 4) Remove or inspect any unicode-control characters in SKILL.md (scanner flagged potential prompt-injection). 5) If you intend to test, do so in a sandbox (throwaway VM or container), and rotate any WeChat credentials that may have been exposed by the repo. 6) Prefer a version that requires explicit env vars for credentials (declared in metadata) and confines file I/O to the skill workspace rather than absolute root paths. If the author cannot address these issues, consider the skill unsafe for use with real account credentials.

微信公众号工具包

完整的微信公众号运营工具集，覆盖内容创作、封面设计、自动发布全流程。

核心功能

1. 文章创作

• 热点追踪：自动抓取今日热点
• 内容生成：基于热点创作文章
• 排版优化：段落分明，结构清晰
• 极简风格：无emoji，无图片，纯文字

2. 封面设计

• 白底手绘黑白极简风格
• 黑白科技风设计
• 自动尺寸适配（900x500）
• 支持PNG/JPG格式

3. 自动发布

• 一键发布到草稿箱
• 自动上传封面到素材库
• 自动清理旧草稿
• 完整发布流程管理

4. 热点分析

• 实时热点抓取
• 关键词提取
• 趋势分析
• 选题建议

使用方法

创作并发布文章

# 完整工作流（推荐）
node scripts/full-workflow.js

# 仅生成文章
node scripts/create-article.js

# 仅生成封面
node scripts/generate-cover.js

# 仅发布文章
node scripts/publish-article.js

自定义参数

# 指定文章主题
node scripts/create-article.js --topic "AI技术"

# 指定封面风格
node scripts/generate-cover.js --style "minimal"

# 定时发布
node scripts/schedule-publish.js --time "18:00"

配置说明

微信公众号配置

编辑 config/wechat-config.json：

{
  "appID": "your_app_id",
  "appSecret": "your_app_secret",
  "apiBase": "https://api.weixin.qq.com"
}

封面设计配置

编辑 config/cover-config.json：

{
  "style": "minimal-black-white",
  "width": 900,
  "height": 500,
  "format": "png"
}

目录结构

wechat-mp-toolkit/
├── SKILL.md                 # 技能说明文档
├── scripts/                 # 核心脚本
│   ├── full-workflow.js     # 完整工作流
│   ├── create-article.js    # 文章创作
│   ├── generate-cover.js    # 封面生成
│   ├── publish-article.js   # 文章发布
│   ├── hotspot-analyzer.js  # 热点分析
│   └── schedule-publish.js  # 定时发布
├── config/                  # 配置文件
│   ├── wechat-config.json   # 微信配置
│   └── cover-config.json    # 封面配置
├── templates/               # 文章模板
│   ├── tech-article.md      # 科技文章模板
│   ├── news-article.md      # 新闻文章模板
│   └── opinion-article.md   # 评论文章模板
└── examples/                # 示例文件
    ├── example-article.md   # 示例文章
    └── example-cover.png    # 示例封面

依赖要求

系统依赖

• Node.js 14+
• ImageMagick（用于图片处理）
• curl（用于API调用）

Node.js 包

• axios - HTTP请求
• form-data - 文件上传
• cheerio - HTML解析（可选）

安装依赖

# 安装Node.js包
npm install axios form-data

# 安装ImageMagick（Ubuntu/Debian）
sudo apt-get install imagemagick

# 安装ImageMagick（CentOS/RHEL）
sudo yum install imagemagick

工作流程

标准流程

1. 热点抓取 → 获取今日热点
2. 文章创作 → 基于热点创作内容
3. 封面生成 → 设计白底手绘黑白封面
4. 文章发布 → 自动上传并创建草稿

自定义流程

根据需要组合使用各个独立脚本：

# 只创作文章（不发布）
node scripts/create-article.js --topic "科技" --output article.md

# 只生成封面
node scripts/generate-cover.js --title "文章标题" --output cover.png

# 手动发布已有文章
node scripts/publish-article.js --article article.md --cover cover.png

输出规范

文章格式

• 标题：简洁有力，不超过30字
• 摘要：100-150字，概括核心内容
• 正文：1500-2000字，段落分明
• 格式：Markdown格式，无emoji，无图片

封面规格

• 尺寸：900x500像素
• 格式：PNG（推荐）或 JPG
• 大小：10-50KB
• 风格：白底手绘黑白极简

高级功能

1. 定时发布

设置定时任务，自动在指定时间发布：

# 每天早上8点发布
0 8 * * * cd /path/to/wechat-mp-toolkit && node scripts/schedule-publish.js

2. 批量操作

批量创作和发布多篇文章：

node scripts/batch-publish.js --count 5 --interval 3600

3. 数据统计

查看发布统计和分析：

node scripts/stats.js --period week

注意事项

1. API限制：微信公众号API有调用频率限制
2. 网络要求：需要稳定的网络连接
3. 封面格式：仅支持PNG和JPG，不支持SVG
4. 草稿管理：建议定期清理旧草稿
5. 内容审核：确保内容符合平台规范

故障排除

问题：封面上传失败

原因：格式不支持或文件过大

解决：

• 确保使用PNG或JPG格式
• 压缩图片到50KB以内
• 检查图片尺寸是否为900x500

问题：文章发布失败

原因：API参数错误或权限不足

解决：

• 检查appID和appSecret是否正确
• 确认IP白名单已配置
• 验证access_token是否有效

问题：热点抓取失败

原因：网络问题或源站限制

解决：

• 检查网络连接
• 尝试更换热点源
• 使用代理（如需要）

更新日志

v1.0.0 (2026-03-15)

• ✅ 初始版本发布
• ✅ 支持完整工作流程
• ✅ 白底手绘黑白封面生成
• ✅ 极简风格文章创作
• ✅ 自动发布到草稿箱

贡献指南

欢迎提交问题和改进建议！

许可证

MIT License

---

关键词：微信公众号、内容创作、自动化、封面设计、热点分析

适用场景：公众号运营、内容营销、自动化发布

技能等级：A级 - 生产可用