Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Wechat Mp Auto

v0.1.2

自动完成微信公众号文章的选题调研、Markdown写作、智能配图、内容审核和发布全流程管理。

1· 272·0 current·0 all-time
byW.Zhaojin@wzhaojin

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for wzhaojin/wechat-mp-auto.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Wechat Mp Auto" (wzhaojin/wechat-mp-auto) from ClawHub.
Skill page: https://clawhub.ai/wzhaojin/wechat-mp-auto
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install wechat-mp-auto

ClawHub CLI

Package manager switcher

npx clawhub@latest install wechat-mp-auto
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill's name/description (WeChat MP automation) aligns with the included code (token_manager, publish, draft_skill, material_skill, image generation/search, content review). However the registry summary at the top of the bundle claims 'Required env vars: none' and 'Homepage: none' while metadata.json and SKILL.md clearly require WECHAT_APP_ID/WECHAT_APP_SECRET and reference a GitHub homepage — this mismatch is an incoherence in packaging/metadata.
Instruction Scope
SKILL.md limits AI orchestration to calling the provided tools and documents the exact sequence (research → outline → generate Markdown with LLM → review → images → convert → draft). The runtime instructions reference only expected files/paths (~/.config/wechat-mp-auto/config.json, ~/.openclaw/.env, ~/.cache/wechat-mp-auto) and external services needed for the stated purpose (WeChat API, Tavily/DuckDuckGo/Baidu for research, Pexels/Unsplash/AIs for images). I saw no instructions that would cause the agent to read unrelated system files or exfiltrate arbitrary secrets beyond the declared configuration locations.
Install Mechanism
There is no install spec (instruction-only at registry level) but the skill bundle includes many Python files and a publish script. No remote download/install-from-URL behavior was declared. Dependencies are simple (requests, PyYAML) and optional image/AI libs. No high-risk installer steps detected in the provided files.
!
Credentials
The skill legitimately needs WeChat credentials (WECHAT_APP_ID, WECHAT_APP_SECRET) and optionally image/search/API keys (PEXELS, UNSPLASH, OPENAI, TAVILY) — these are proportional to publishing, research and image generation. The concern is a packaging/metadata inconsistency: the registry summary incorrectly lists 'Required env vars: none' while metadata.json and SKILL.md require WeChat credentials. There are also multiple optional third-party provider keys (image providers and many possible image-gen backends in comments) — verify you only supply keys you trust. Version fields are inconsistent across files (src/_version.py, metadata.json, README, etc.), which suggests sloppy packaging and raises the risk that the published bundle may not match the referenced upstream repository.
Persistence & Privilege
The skill does not request 'always: true' and does not attempt to modify other skills. It stores config and caches under ~/.config/wechat-mp-auto and ~/.cache/wechat-mp-auto and caches tokens (expected for this use case). This is normal for a tool that needs to hold API credentials and temporary artifacts.
What to consider before installing
Summary of what to check before installing: 1) Metadata mismatch: the top-level registry listing said no env vars, but SKILL.md and metadata.json require WECHAT_APP_ID and WECHAT_APP_SECRET (or a config file at ~/.config/wechat-mp-auto/config.json). Do not run the skill without those WeChat credentials in a controlled environment. 2) Verify source and versions: metadata.json lists a GitHub homepage but the registry summary said none and several files contain inconsistent versions (src/_version.py, metadata.json, README, SKILL.md). Prefer installing from a trusted upstream repository and confirm version consistency. 3) Credential scope: the skill legitimately needs your WeChat AppID/Secret and optionally keys for Pexels/Unsplash/Tavily/OpenAI if you enable those features. Only provide API keys you trust and consider creating limited-scope/test accounts where possible. 4) Network behavior: the skill performs outbound requests for research (Tavily/DuckDuckGo/Baidu), image search/download (Pexels/Unsplash), and may call multiple AI image providers (many backends are listed). If you must protect sensitive network contexts, run the skill in an isolated environment or sandbox and ensure your server IP is added to your WeChat IP whitelist as required. 5) Check config files and caches: it will read/write ~/.config/wechat-mp-auto/* and ~/.cache/wechat-mp-auto/* and ~/.openclaw/.env. Inspect these locations after a test run; delete token cache files if you revoke credentials. 6) Run initial tests without real credentials: if possible, run the code in 'check-only' or dry-run modes (publish.py supports --check-only) to observe behavior before granting publish-level credentials. If you want, I can point out the exact files/lines where the WECHAT credential reads occur and where optional provider lists are defined, or produce a short checklist to safely test this skill in a sandboxed environment.

Like a lobster shell, security has layers — review code before you run it.

latestvk97e1hec3ymx4cy7rxmh0pf24x83g5t0
272downloads
1stars
13versions
Updated 22h ago
v0.1.2
MIT-0

wechat-mp-auto - 微信公众号自动化 Skill

版本: v0.1.2 描述: 微信公众号文章从选题到发布的全流程自动化


架构理念

本 Skill 由 AI 模型作为编排者,Python 代码提供原子化工具能力。AI 读取本 SKILL.md 后自行决定调用哪些工具、完成全部流程。

Python 代码不包含任何 AI 调用逻辑,所有生成、推理、判断均由 AI 模型完成。


工具清单

AI 可调用的所有工具如下,调用时请传入完整参数:

1. 调研工具

research_topic(topic: str, keywords: Optional[List[str]] = None) -> dict

  • 输入:文章主题(字符串),可选的关键词列表(用于精细化搜索)
  • 输出:{"search_results": [...], "summary": "..."}
  • 作用:对给定主题进行网络调研,返回搜索结果摘要
  • 内部级联:Tavily → DuckDuckGo → 百度,任一成功即返回

generate_outline(topic: str, research: dict) -> dict

  • 输入:主题字符串 + research_topic 的返回结果
  • 输出:
{
  "title": "深度解析:XXX",
  "sections": [
    {"name": "引言", "description": "...", "key_points": ["要点1", "要点2"]},
    {"name": "核心内容", "description": "...", "key_points": [...]},
    ...
  ]
}
  • 作用:根据调研结果生成文章大纲,包含 4 个标准章节(引言/核心内容/实践方法/结论)

2. 写作工具

convert_to_html(markdown: str, theme: str) -> str

  • 输入:Markdown 格式文章内容 + 主题名称
  • 输出:微信可用的 HTML 字符串
  • 主题可选值:
    • default — 默认蓝色
    • macaron — 马卡龙粉紫色
    • shuimo — 水墨深灰蓝
    • wenyan — 文雁深蓝绿
    • houge — 猴哥深蓝橙
    • cuiyu — 翠玉青绿黄

3. 图片工具

search_image(query: str, count: int) -> list

  • 输入:搜索关键词(字符串),请求图片数量(整数)
  • 输出:图片信息列表,每个元素含 url(下载链接)和 local_path(本地缓存路径)
  • 作用:通过 Pexels/Unsplash 图库搜索并下载图片,返回本地文件路径
  • 注意:如未配置图库 API Key,此工具不可用

generate_image(prompt: str, size: str) -> dict

  • 输入:图片描述提示词(字符串),图片尺寸(字符串,格式如 "1024x1024"
  • 输出:{"local_path": "本地文件路径"}
  • 作用:调用 AI 生图模型生成图片,返回本地保存路径

upload_image(file_path: str) -> dict

  • 输入:本地图片文件路径(字符串)
  • 输出:{"media_id": "...", "url": "微信图片URL"}
  • 作用:将本地图片上传至微信素材库,返回微信图片 URL 和 media_id
  • 注意:上传前需确保图片文件存在,支持 JPG/PNG

4. 内容审核工具

review_article(article: dict) -> dict

  • 输入:文章对象,格式如下:
{
  "markdown": "Markdown 内容(字符串)",
  "content": "HTML 内容(字符串,可选)"
}
  • 输出:
{
  "passed": true/false,
  "plagiarism": {"similarity": 0, "is_duplicated": false},
  "prohibited": {"violations": []}
}
  • 作用:审核文章内容,返回是否通过及问题列表

5. 草稿工具

create_draft(articles: list, auto_upload_thumb: bool = False) -> dict

  • 输入:文章列表,每篇格式如下:
{
  "title": "文章标题",
  "author": "贾维斯",
  "content": "HTML内容(字符串)",
  "thumb_media_id": "封面缩略图的media_id",
  "content_source_url": "原文链接,可填 https://openclaw.ai"
}
  • 输出:{"media_id": "草稿ID", "msg": "..."}
  • 作用:将文章推送到微信公众号草稿箱

AI 编排流程

AI 读取本 SKILL.md 后,按以下步骤执行。每一步都需要显式调用对应工具:

第一步:调研
  → 调用 research_topic(topic)
  → 获得 search_results 和 summary

第二步:生成大纲
  → 调用 generate_outline(topic, research结果)
  → 获得 title 和 sections(含章节名、描述、要点)

第三步:组装提示词并生成文章
  → 根据第二步的大纲,自行组装提示词(见下方"提示词组装规范")
  → 用大模型根据提示词生成完整的 Markdown 文章
  → 注意:大模型直接输出 Markdown,不需要调用任何工具来"写作"

第四步:内容审核
  → 调用 review_article({"markdown": 第三步生成的Markdown})
  → 如 passed=false 或存在 prohibited.violations,应重新生成或修改内容
  → 审核通过后再进入第五步

第五步:生成并上传配图
  → 生成封面图(generate_images=True 时):
    - 优先调用 search_image(文章标题关键词, count=5),下载到本地
    - 或调用 generate_image(封面图描述, size="900x500"),得到本地路径
  → 调用 upload_image(封面图本地路径) → 获得封面微信URL
  → 为每个章节生成一张配图:
    - 优先调用 search_image(章节标题关键词, count=3)
    - 或调用 generate_image(章节图描述, size="900x500")
  → 分别调用 upload_image(章节图本地路径) → 获得章节图的微信URL

第六步:注入图片URL到Markdown
  → 将微信图片URL以 Markdown 图片语法插入内容:
    - 封面图:在第一个 # 标题后插入 `![封面](封面微信URL)`
    - 章节图:在对应 ## 标题行后插入 `![章节名](章节微信URL)`
  → 注意:图片URL直接插入 Markdown,不是 HTML 占位符

第七步:转换格式
  → 调用 convert_to_html(Markdown字符串, theme参数)
  → Markdown 中的 `![name](url)` 自动转为 `<img src="url" alt="name" style="max-width:100%;..." />`
  → 获得 HTML 字符串

第八步:推送草稿
  → 调用 upload_thumb(封面图本地路径) → 获得 thumb_media_id(素材缩略图ID)
  → 调用 create_draft([{
    "title": 文章标题,
    "author": "贾维斯",
    "content": 包含图片URL的完整HTML,
    "thumb_media_id": 封面缩略图的media_id,
    "content_source_url": "https://openclaw.ai"
  }])
  → 获得草稿ID,流程完成


批量生成多篇文章

单篇文章流程(第一步至第八步)为一轮。当需要生成多篇文章时,按以下方式循环执行:

对第 1 篇文章执行第一步至第八步
  → 等待第八步完成后,再开始第 2 篇

对第 2 篇文章执行第一步至第八步
  → 等待完成后,再开始第 3 篇

... 以此类推

每篇文章之间相互独立,主题、大纲、写作风格均可不同。


提示词组装规范

第三步中,AI 组装提示词时应包含以下部分,以结构化方式呈现:

## 文章主题
{topic}

## 文章大纲
{section_name_1}
  描述:{section.description}
  关键要点:{section.key_points列表}

{section_name_2}
  ...

## 调研资料摘要
{research.summary}
(包含3-5条最相关的搜索结果摘要)

## 写作风格要求
{从以下选项中选择或组合:}
- 口语化 / 正式 / 俏皮 / 专业 / 通俗易懂
- 段落之间逻辑连贯,有真知灼见
- 禁止空洞套话

## 输出格式要求
- 主标题:# 标题(一级,仅一个)
- 章节标题:## 二级标题
- 子章节:### 三级标题
- 重点词语:**加粗**
- 代码块:```bash 代码 ``` 格式
- 列表:- 格式
- 全文字数:不超过 7200 字
- 禁止重复章节或段落

## 配图标记说明
- 封面图位置:在文章开头,标题后插入 ![封面](cover_image_url)
- 章节图位置:在每个 ## 章节标题正后方插入 ![章节标题](章节标题_url)
- **重要**:每个章节的占位符必须是**唯一的**,占位符名称 = 章节标题(不含空格和特殊字符)+"_url"
  - 示例:章节"OpenClaw 简介" → `![OpenClaw简介](OpenClaw简介_url)`
  - 示例:章节"环境准备" → `![环境准备](环境准备_url)`
  - **禁止**所有章节图使用相同的占位符(如 `section_image_url`)
- 占位符说明:图片 URL 暂时填入上述占位符,后续第五、六步会上传真实微信图片URL并替换

## 重要约束
- 输出内容到此为止,不输出任何检查清单、打分表、自评或额外说明
- 全文每个章节只出现一次,不得重复输出任何章节或段落

配置要求

必需

  • 微信公众号凭证(二选一):
    1. ~/.config/wechat-mp-auto/config.json 中配置 app_idapp_secret
    2. 或在 ~/.openclaw/.env 中配置环境变量 WECHAT_APP_IDWECHAT_APP_SECRET
  • IP 白名单:确保运行环境的出口 IP 已加入微信公众号后台的白名单

可选

  • 图片来源(二选一):
    • PEXELS_API_KEY:Pexels 图库(每月 200 请求,优先横图)
    • UNSPLASH_API_KEY:Unsplash 图库(每月 50 请求,优先横图)
    • 图片下载后自动压缩:封面最大 900×500,插图最大 900×400,统一转 JPEG 85% 质量
    • 环境变量或 ~/.openclaw/.env 中配置

目录结构

wechat-mp-auto/
├── SKILL.md                    # 本文档(AI 编排指南)
├── metadata.json                # Skill 元数据
├── _meta.json                  # ClawHub 元数据
├── README.md                    # 人类使用说明
├── requirements.txt            # Python 依赖
├── src/
│   ├── config.py              # 配置管理
│   ├── token_manager.py       # 微信 Access Token 管理
│   ├── exceptions.py         # 异常定义
│   └── skills/
│       ├── topic_research.py  # 调研工具(research_topic / generate_outline)
│       ├── article_writer.py  # 格式转换工具(convert_to_html)
│       ├── image_generator.py # 图片工具(search_image / generate_image)
│       ├── material_skill.py  # 图片上传工具(upload_image)
│       ├── draft_skill.py     # 草稿推送工具(create_draft)
│       ├── base_skill.py      # 基础类
│       ├── content_reviewer.py # 内容审核
│       └── ...                # 其他辅助模块
└── themes/                    # HTML 主题配色
    ├── default.yaml
    ├── macaron.yaml
    ├── shuimo.yaml
    ├── wenyan.yaml
    ├── houge.yaml
    └── cuiyu.yaml

安全规范

  • Skill 代码中不存储任何凭证
  • 日志中自动脱敏(密钥前 4 位 + ... + 后 4 位)
  • 所有凭证从配置文件或环境变量读取,不硬编码

接口权限说明

以下是部分接口对公众号类型的要求:

接口/功能权限要求
素材管理(上传/下载图片)普通订阅号即可
草稿箱管理普通订阅号即可
文章数据统计(阅读量/点赞/转发等)服务号或已认证的订阅号可查询,普通订阅号调用返回 404
用户管理(获取用户信息)普通订阅号即可(部分接口受限)
群发/模板消息需服务号或已认证订阅号

注意:如需使用文章数据分析功能,请将公众号升级为服务号或完成认证。

Comments

Loading comments...