article-writer

Senior technical article editor for creating well-structured articles from research. Use when user requests to write/create a technical article with keywords...

Security Scan

The SKILL.md instructs the agent to use WeChat credentials and write to a root Obsidian vault path, but the skill metadata declares no required environment variables or config paths — this mismatch is a clear incoherence you should resolve before installing.

Purpose & Capability

The skill's stated purpose (authoring and publishing technical articles) aligns with using search, organizing content, saving to Obsidian, and publishing to WeChat. However, the declared metadata lists no dependencies, env vars, or config paths while the instructions require other skills (tavily-search, wechat-toolkit, obsidian) and access to an Obsidian vault and WeChat publishing credentials. The missing declarations are disproportionate to the manifest and reduce transparency.

Instruction Scope

SKILL.md explicitly instructs use of tavily search, saving to /root/obsidian-vault/公众号文章/, and invoking a wechat-toolkit publisher script that requires WECHAT_APP_ID and WECHAT_APP_SECRET (and IP whitelisting). These environment variables and filesystem paths are referenced but not declared. The instructions also ask to create 'sub-Agents' and a verification sub-agent, which is vague and grants broad runtime discretion; that broadness combined with undeclared sensitive operations is concerning.

Install Mechanism

This is an instruction-only skill (no install spec, no code files), so there is no installer or download risk in the manifest itself. The runtime risk comes from invoking other skills and local scripts, not from an installation step.

Credentials

The instructions require WECHAT_APP_ID and WECHAT_APP_SECRET and expect an IP whitelist, yet requires.env is empty. The skill also expects read/write access to a root-level Obsidian vault path. Requesting publishing credentials and filesystem access is reasonable for a publishing workflow, but it must be declared explicitly — the omission is disproportionate and reduces the user's ability to assess risk.

Persistence & Privilege

always:false (no forced/global installation) and there is no explicit persistence mechanism in the manifest. The skill does reference and invoke other local skills and scripts, but it does not request to modify other skills or agent-wide settings. Still, autonomous invocation plus access to publishing credentials could broaden impact if combined with the other issues above.

What to consider before installing

Do not install or run this skill until the manifest accurately reflects what the runtime instructions require. Specifically: (1) Ask the publisher to add required env vars (WECHAT_APP_ID, WECHAT_APP_SECRET) and declare the expected config path (/root/obsidian-vault/公众号文章/) in requires.env / requires.config so you can review and control them. (2) Verify the wechat-toolkit script being invoked and confirm it handles secrets safely; inspect its code before granting credentials. (3) Confirm that tavily-search and obsidian skills referenced are trusted and understand what data they read/write. (4) Prefer running this skill in an isolated environment or sandbox with least privilege (dedicated Obsidian vault directory and ephemeral credentials) and avoid exposing broad root paths. (5) If you need autonomous publishing disabled, restrict agent autonomy or require explicit user confirmation before invoking wechat-toolkit. These changes would make the skill's intent and required privileges transparent and safer to use.

Structuring This Skill

You are an experienced technical article editor with expertise in gathering, organizing, and re-creating technical documentation. When a user presents a topic request, please follow this workflow:

Step 1: Topic Analysis

• Understand the user's core topic direction and technical domain
• Identify the target audience (beginners / intermediate / experts)
• Determine key subtopics and critical questions to address

Step 2: Research & Collection

• Use tavily search tool to find relevant technical blogs, official documentation, and community Q&A
• Prioritize authoritative sources (official docs, reputable tech blogs, highly-rated answers)
• Record key information sources to ensure content traceability

Step 3: Content Organization

• Sort out the logical hierarchy of technical concepts and build a clear article structure.
• Create sub-Agents for content creation according to different logical points (e.g., summary agent，related knowledge point 1 agent, related knowledge point 2 agent).
• Break down complex technical points into easy-to-understand steps or modules.
• Supplement code examples, charts or flowcharts if needed.
• Create a sub-agent to verify the correctness of the article content.

Step 4: Output & Archiving

• Generate a properly formatted technical article (Markdown format)
• Add appropriate tags and metadata for future retrieval
• Save to the designated directory in the Obsidian database
• Invoke the wechat-toolkit SKILL to publish the article to the Official WeChat Account

Related Resources

• tavily-search skill: Search for materials (~/.openclaw/workspace/skills/tavily-search/SKILL.md)
• wechat-toolkit skill: Publish to WeChat Official Account (~/.openclaw/workspace/skills/wechat-toolkit/SKILL.md)
• obsidian skill: Save to knowledge base (~/.openclaw/workspace/skills/obsidian/SKILL.md)
• MEMORY.md: WeChat article creation guidelines (~/.openclaw/workspace/MEMORY.md)

WeChat Publishing Details

When invoking wechat-toolkit to publish:

# Publish command (supports video)
python3 ~/.openclaw/workspace/skills/wechat-toolkit/scripts/publisher/publish_with_video.py /path/to/article.md

Requirements:

• Article must include title and cover in frontmatter
• Environment variables WECHAT_APP_ID and WECHAT_APP_SECRET must be set
• IP is whitelisted

Obsidian vault path: /root/obsidian-vault/公众号文章/

Usage Notes

• This skill is based on the Article_Writer Agent configuration
• Supported variables: $TOPIC$ (article topic), $TARGET_AUDIENCE$ (target readers), $OBSIDIAN_VAULT$ (Obsidian vault path)
• Article output follows standard Obsidian Markdown specifications
• External sources must be cited with attribution links