WeChat Article Reader

Read WeChat public account (微信公众号) articles. Activate when the user shares a mp.weixin.qq.com link, asks to read/summarize a WeChat article, or mentions 公众号/...

Security Scan

The skill's purpose and instructions are coherent for reading JS-rendered WeChat articles, but its use of a browser profile (profile="openclaw") creates a privacy/credential access risk that isn't justified or explained.

Purpose & Capability

Name/description match the instructions: WeChat public-account pages are JS-rendered and the SKILL.md correctly prescribes browser automation to extract full article text. No unrelated binaries, env vars, or installs are requested.

Instruction Scope

Instructions are precise (detect mp.weixin.qq.com URLs, open via browser tool, snapshot, close). They remain within the stated purpose. However the instructions explicitly specify using a browser profile (profile="openclaw") and suggest scrolling/multiple snapshots for very long articles — actions that can broaden what gets captured (e.g., other page content, additional requests) and increase the amount of user data collected.

Install Mechanism

Instruction-only skill with no install spec and no code files; nothing is written to disk by the skill itself. This is the lowest-risk install profile.

Credentials

Although no environment variables or credentials are declared, the use of a named browser profile is the main concern: if that profile maps to an existing browser session it may expose cookies, auth tokens, or other site session data (including logged-in WeChat sessions or unrelated site accounts). The skill does not document what the profile is or whether an ephemeral profile will be used, so credential exposure is possible.

Persistence & Privilege

The skill is not always-enabled and requests no persistent system privileges or config writes. It does not modify other skills or system settings according to the manifest.

What to consider before installing

This skill appears to do what it says (use a browser to render and snapshot WeChat articles), but ask the publisher or maintainer what 'profile="openclaw"' means before installing. That profile may reuse stored browser cookies or logins and could expose session tokens or other sites' data. Prefer an ephemeral/isolated browser profile or require explicit user confirmation when a login wall is encountered. If you need stronger assurance, request the SKILL.md be updated to: (1) avoid referencing a persistent profile or (2) state that an ephemeral profile will be used, and (3) require user consent before loading pages that trigger login walls or capture content beyond the article body.

Why This Skill Exists

WeChat public account articles (mp.weixin.qq.com/s/...) are fully JS-rendered and have anti-scraping measures. web_fetch only returns the title. Browser automation is required to get the full content.

How to Read an Article

1. Detect mp.weixin.qq.com URLs in user messages
2. Open with browser tool:

browser(action="open", url="<article_url>", profile="openclaw")

3. Wait for render, then snapshot:

browser(action="snapshot", targetId=<id>, maxChars=15000)

4. Close the tab:

browser(action="close", targetId=<id>)

5. Present the content to the user (summarize or translate as requested)

Tips

• Articles may contain images — snapshot captures alt text and captions
• Very long articles: increase maxChars to 30000 or use multiple snapshots with scrolling
• If the page shows "此内容因违规无法查看" (content removed), inform the user
• Some articles require WeChat login — if snapshot shows a login wall, inform the user
• For multiple articles, process sequentially to avoid resource waste