Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

wewe-rss WeChat Export

v1.0.0

适配 wewe-rss 的公众号抓取与导出工具:把微信公众号 / JSON feed 批量导出为清洗后的 DOCX 文档,并支持日期前缀命名与 zip 打包。适用于导出公众号文章、批量生成 Word 交付包、保留正文清洗结果等场景。

0· 110·0 current·0 all-time
byWanli Chen@n1neman

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for n1neman/wewe-rss-wechat-export.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "wewe-rss WeChat Export" (n1neman/wewe-rss-wechat-export) from ClawHub.
Skill page: https://clawhub.ai/n1neman/wewe-rss-wechat-export
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install wewe-rss-wechat-export

ClawHub CLI

Package manager switcher

npx clawhub@latest install wewe-rss-wechat-export
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
Name/description match the included scripts and README. The package contains export scripts that fetch JSON feeds, clean HTML, localize images, and call pandoc to produce DOCX — which is coherent with an exporter. Manifest network permission is appropriate for fetching feeds.
Instruction Scope
SKILL.md and the scripts restrict runtime behavior to fetching feed URLs, cleaning/html-to-docx conversion, local image downloads, writing results into the chosen output directory, and optional zipping. Installation instructions read the OpenClaw workspace config (~/.openclaw/openclaw.json) to determine install destination — this is expected for installing into the platform but is something to be aware of. The scripts run subprocesses (curl, node, pandoc, python3) and perform network I/O and filesystem writes (output_dir); this is necessary for the stated task but you should run it with feeds you trust and in an appropriate directory to avoid accidental overwrites.
Install Mechanism
There is no automated installer that downloads remote code. INSTALL.md instructs manual copying/unzip into the OpenClaw workspace and restarting the gateway. No external archive URLs or opaque downloads are used by the skill itself.
Credentials
The skill declares no required environment variables or credentials. It optionally respects EXPORT_FEED_OUTPUT_ROOT as a convenience. It does not request unrelated secrets or system-wide credentials; requested binaries (node, pandoc, curl, python3) are reasonable for the task.
Persistence & Privilege
always:false and user-invocable; the skill does not request persistent platform privileges or modify other skills' configurations. Installation writes files into the OpenClaw workspace (expected for a skill) and suggests restarting the gateway — normal for installing local skills.
Assessment
This skill appears to be what it says: a feed->DOCX exporter implemented as Node/Bash scripts. Before installing: (1) Verify required binaries (node, pandoc, curl, python3) are present and up-to-date. (2) Run the export in a controlled folder to avoid overwriting important files (the script writes into output_dir). (3) Only feed URLs you trust / are allowed to scrape; the tool will perform network requests and download images/resources from the feed. (4) Installation reads your OpenClaw workspace config (~/.openclaw/openclaw.json) to determine where to place files — review the INSTALL.md steps and run them manually if you prefer. (5) If you need higher assurance, review the full export-feed-single-pages.mjs script (included) to confirm no unexpected endpoints or behavior for your use case.
scripts/export-feed-single-pages.mjs:187
Shell command execution detected (child_process).
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.

Like a lobster shell, security has layers — review code before you run it.

docxvk97cxrhk40qpkzvkyr6ggesj6183g9emexportvk97cxrhk40qpkzvkyr6ggesj6183g9emlatestvk97cxrhk40qpkzvkyr6ggesj6183g9empublic-accountvk97cxrhk40qpkzvkyr6ggesj6183g9emwechatvk97cxrhk40qpkzvkyr6ggesj6183g9emwewe-rssvk97cxrhk40qpkzvkyr6ggesj6183g9em
110downloads
0stars
1versions
Updated 1mo ago
v1.0.0
MIT-0

wewe-rss WeChat Export

适配 wewe-rss 的公众号抓取与文档导出工具。

它做什么

这个 skill 用于把符合 wewe-rss / JSON Feed 风格的公众号 feed 批量导出为清洗后的 Word 文档,并按需要生成 zip 交付包。

核心能力:

  • 分页抓取 feed
  • 清洗公众号文章正文
  • 过滤脚本、样式和页面级垃圾标签
  • 图片本地化
  • Pandoc 转 DOCX
  • 生成 index.txt 汇总
  • 可选打包为 zip

适用场景

当用户想做这些事情时使用本 skill:

  • 导出微信公众号文章为 DOCX
  • 把 wewe-rss feed 做成可交付文档包
  • 给导出文件自动加日期前缀
  • 批量抓取公众号文章并打包
  • 保留 HTML / Markdown / DOCX 作为验收产物

执行原则

  1. 统一通过 scripts/run-export-feed.sh 调用。
  2. 不在 skill 内重复实现导出逻辑。
  3. 默认交付参数优先选择:
    • --output-mode docx
    • --rename-mode dated
    • --zip
  4. 导出前检查依赖:nodepandoccurlpython3
  5. 若未指定输出目录,默认输出到当前工作目录下的 export/
  6. --batch-size 最大限制为 5,避免过度抓取。

参数格式

bash <skill_dir>/scripts/run-export-feed.sh <feed_url> [count] [output_dir] [--batch-size N] [--output-mode docx|full] [--rename-mode dated|plain] [--zip]

位置参数

  • feed_url:必填,公众号 / wewe-rss feed JSON 地址
  • count:可选,默认 100
  • output_dir:可选,默认落到当前工作目录 export/

可选项

  • --batch-size N:分页批大小,默认 2,最大 5
  • --output-mode docx|full
    • docx:仅保留适合交付的 DOCX 结果
    • full:保留 HTML / Markdown / DOCX 与资源目录
  • --rename-mode dated|plain
    • datedYYYY-MM-DD-序号-标题.docx
    • plain序号-标题.docx
  • --zip:导出完成后额外生成 zip

推荐用法

最终交付型导出

bash <skill_dir>/scripts/run-export-feed.sh \
  "https://example.com/feed.json" \
  100 \
  "./export/my-feed" \
  --batch-size 5 \
  --output-mode docx \
  --rename-mode dated \
  --zip

小样本验收

bash <skill_dir>/scripts/run-export-feed.sh \
  "https://example.com/feed.json" \
  5 \
  "./export/my-feed-smoke" \
  --batch-size 1 \
  --output-mode full \
  --rename-mode dated

输出约定

成功后,至少返回:

  • output_dir
  • index_path
  • zip_path(如果启用了 --zip
  • output_mode
  • rename_mode

目录结构

wewe-rss-wechat-export/
├── CHANGELOG.md
├── INSTALL.md
├── LICENSE
├── README.md
├── SKILL.md
├── _meta.json
├── manifest.yaml
└── scripts/
    ├── export-feed-single-pages.mjs
    └── run-export-feed.sh

Comments

Loading comments...