WeChat MP Multi-Publisher

Publish one or multiple Markdown articles to WeChat Official Account (公众号) draft box in a single API call. Supports multi-article combined drafts (main artic...

Security Scan

The skill's code and docs require WeChat credentials and read local config/files and upload assets to external services, but the registry metadata does not declare those required credentials or an install step — the mismatch and missing provenance warrant caution.

Purpose & Capability

The skill's stated purpose (publishing Markdown to WeChat MP) matches the included script's behavior (rendering markdown, uploading covers/inline images, creating drafts). However the registry metadata listed no required environment variables or primary credential, while the SKILL.md and scripts clearly require WECHAT_APP_ID and WECHAT_APP_SECRET (or a credentials file). That discrepancy between declared metadata and actual requirements is a material inconsistency.

Instruction Scope

Runtime instructions and the script direct the agent to read credentials from env vars or ~/.config/wechat-mp/credentials.json, read local markdown and image files, render HTML, upload inline images to WeChat CDN, fetch cover images from Unsplash, and call WeChat APIs. Those actions are within the claimed purpose but are broader than the registry's 'no env vars' claim. The instructions will access local filesystem paths and network endpoints (api.weixin.qq.com, source.unsplash.com, images.unsplash.com), so users should expect local files and credentials to be used and transmitted to remote services.

Install Mechanism

There is no formal install spec in the registry (instruction-only), but SKILL.md and references/setup.md instruct the user to run `npm install @wenyan-md/core`. This is a moderate-risk pattern because dependencies are not installed automatically by a verified installer; the dependency should be audited before installation. The code itself is bundled (publish.mjs) rather than downloaded from a remote URL at install time, which reduces arbitrary remote-install risk.

Credentials

The script requires sensitive credentials (WECHAT_APP_ID and WECHAT_APP_SECRET) and can read a credentials file under ~/.config/wechat-mp. Those credentials are necessary for interacting with WeChat APIs, so their request is proportionate to the skill's functionality — but the registry metadata failed to declare them. That omission increases risk because automated gating or reviewers might not have flagged credential needs. The skill also suggests setting WECHAT_AUTHOR; no other unrelated secrets are requested in the code.

Persistence & Privilege

The skill does not request permanent 'always' inclusion, does not claim to modify other skills or global agent settings, and does not include an install step that writes persistent privileged configuration. It only reads a per-user credentials file and environment variables, which is expected for this purpose.

What to consider before installing

This skill appears to implement a legitimate WeChat MP publisher, but there are important red flags to consider before installing: (1) the registry metadata claims no required env vars, but both SKILL.md and the script need WECHAT_APP_ID and WECHAT_APP_SECRET (or a credentials file) — verify this mismatch and treat the credentials as sensitive; (2) the script will read local markdown and image files and upload images to Unsplash and WeChat endpoints — ensure you only process non-sensitive files and run a dry-run first; (3) the package depends on @wenyan-md/core (install manually after auditing that package); (4) source/homepage/owner provenance is limited — prefer skills with a known repository or verify the publish.mjs source fully before use. Recommended actions: inspect the full publish.mjs file locally, run the --dry-run mode first, create and use a minimal-scope WeChat test account for credentials, whitelist only trusted server IPs, and review the @wenyan-md/core dependency before npm install.

wechat-mp-publisher

Publish Markdown articles to WeChat Official Account draft box.

Key features

• Multi-article push — main article + up to 7 sub-articles in one draft (unique vs single-article tools)
• Smart cover images — keyword-matched Unsplash + 12-image fallback pool, each article gets a different cover
• Custom styling — gold quote highlights, && section dividers, accent-colored headings
• Inline images — local PNG/JPG auto-uploaded to WeChat CDN
• Flexible credentials — env vars or ~/.config/wechat-mp/credentials.json

Quick start

# Install dependency
npm install @wenyan-md/core

# Set credentials
export WECHAT_APP_ID=your_appid
export WECHAT_APP_SECRET=your_appsecret

# Push to draft box
node scripts/publish.mjs main-article.md [sub-article.md ...]

See references/setup.md for full credential setup, IP whitelist, and cron automation.

Markdown conventions

Section divider (renders as gradient rule):

paragraph text

&&

next paragraph

Section header (renders as accented H2):

&& My Section Title

Gold quotes — automatically highlighted when text starts with:

• 真正的... / 不是...而是... / 底层逻辑是... / 关键不是...

CLI reference

node scripts/publish.mjs <main.md> [sub1.md] [sub2.md] ...
  --dry-run        Render to /tmp/wechat-preview/ without uploading
  --publish        Also trigger freepublish after draft creation
  --media-id=xxx   Publish an existing draft by media_id

Author field

Set WECHAT_AUTHOR env var to customize the author name shown in WeChat.