Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
全流程微信公众号自动发文 skill
v3.0.0Automate a full local WeChat Official Account publishing workflow: environment setup, content drafting, image prep, publishing, archiving, and optional sched...
⭐ 0· 42·0 current·0 all-time
by@16miku
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Suspicious
high confidencePurpose & Capability
The files (README, SKILL.md, templates, publish.mjs) match the stated purpose: a local WeChat auto-publish workflow. The included publish.mjs implements token retrieval, image upload, draft creation and freepublish calls to api.weixin.qq.com — all coherent with the skill's description. However the registry metadata lists no required environment variables or primary credential, while the documentation and scripts clearly expect WECHAT_APP_ID and WECHAT_APP_SECRET (and optionally GOOGLE_API_KEY/GOOGLE_BASE_URL). This metadata omission is an inconsistency that could mislead users about required secrets.
Instruction Scope
SKILL.md and references stay within the publishing workflow, but the runtime script (publish.mjs) will read local .env-style configuration (the package repeatedly refers to .baoyu-skills/.env and process env) and will clear proxy environment variables before calling WeChat APIs. Reading local .env files is reasonable for a local tool, but it means the skill code will access whatever secrets are present in those paths — ensure those .env files contain only intended keys. The instructions also recommend removing proxy env vars (to ensure direct WeChat connectivity) which alters agent/process environment and may be surprising if you rely on proxies for other services.
Install Mechanism
There is no install spec (instruction-only with some helper scripts), which is low risk. Files are plain templates and a single zero-dependency Node script (publish.mjs). Nothing is downloaded from external arbitrary URLs by the skill itself.
Credentials
Although registry metadata declares no required env vars, the documentation and publish.mjs expect sensitive values (WECHAT_APP_ID, WECHAT_APP_SECRET) to be supplied at runtime via environment or .baoyu-skills/.env. That mismatch is important: the skill will not function without those secrets, yet they are not declared in the registry. The package also references GOOGLE_API_KEY/GOOGLE_BASE_URL for optional image generation. Requiring local .env files and reading them is proportionate to the task, but the omission from metadata and the multiple credential places (process env, .baoyu-skills/.env, ~/.baoyu-skills/.env) create a risk that unrelated secrets could be read if present.
Persistence & Privilege
The skill is not always-included and does not request elevated platform privileges. It doesn't modify other skills or system-wide settings; it provides local run scripts and templates only.
What to consider before installing
This package largely does what it says — it includes documentation, shell templates, and a Node script (publish.mjs) that implements the WeChat publish flow (token, upload images, create draft, optional freepublish). Before running or installing:
- Treat WECHAT_APP_ID and WECHAT_APP_SECRET as sensitive. The skill expects these to be provided externally (process env or .baoyu-skills/.env), but the registry metadata does not declare them — verify and supply them only in a safe .env you control.
- Inspect any .baoyu-skills/.env or ~/.baoyu-skills/.env files the script will read to ensure they contain only intended keys; do not let the skill read an env file that contains unrelated secrets.
- The included publish.mjs clears proxy environment variables to force direct connections to WeChat; if you rely on proxying for other services, be aware the script will mutate the environment (documented in the repo). That behavior is reasonable for direct WeChat API calls but could be surprising in multi-service setups.
- The script makes network calls to api.weixin.qq.com and will perform publishing actions if valid credentials are present—test in a safe environment (draft_only, test account) before running against production accounts.
- Ask the publisher/registry maintainer to update the package metadata to declare the required env vars (WECHAT_APP_ID, WECHAT_APP_SECRET, optional GOOGLE_API_KEY/GOOGLE_BASE_URL) so consumers are not misled.
If you want me to, I can point to the exact lines in publish.mjs that read .env and perform network calls, or suggest a safe way to run the script (containerized, with a scoped .env) for testing.templates/publish.mjs:26
Environment variable access combined with network send.
templates/publish.mjs:17
File read combined with network send (possible exfiltration).
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.Like a lobster shell, security has layers — review code before you run it.
2026.4.6vk973c4w3aty1567176vjxeet9n849rs32026.4.7vk97dgs9s9kcv4nfvdpgzjhp8bd84b2kqlatestvk97dgs9s9kcv4nfvdpgzjhp8bd84b2kq
License
MIT-0
Free to use, modify, and redistribute. No attribution required.