Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Weixin Long Image
v0.1.0Turn Weixin/Wechat replies into readable image cards by rendering HTML into long PNG screenshots. Use when a Weixin direct-chat reply would exceed 150 Chines...
⭐ 0· 86·0 current·0 all-time
byusky@ssochi
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name/description match the shipped assets and script: templates + a renderer that produces full-page PNG screenshots. However, the package metadata declares no required binaries or dependencies while the included script clearly needs Python and the Playwright library (and a Chromium browser). That mismatch is an omission/oversight rather than direct maliciousness, but it is disproportionate to claim 'no required binaries'.
Instruction Scope
SKILL.md limits the agent to composing HTML, rendering it with scripts/render_long_image.py, sending the PNG via the message tool (channel=openclaw-weixin), and deleting temp files afterward. Those actions align with the stated purpose. One runtime nuance: the renderer opens the HTML in a real browser and will load any resources referenced by that page (remote images, CSS, or file:// URLs), which the instructions do not explicitly constrain.
Install Mechanism
There is no install spec, but the script requires Playwright and a Chromium runtime. Playwright often involves fetching browser binaries at install/run time; the skill provides no guidance about installing Playwright, pinning versions, or where the browser will come from. The lack of an install declaration is a coherence/operational risk: the skill will fail or cause unreviewed downloads in some environments.
Credentials
The skill requests no environment variables or external credentials and does not touch unrelated config paths. That is proportionate for its rendering task.
Persistence & Privilege
The skill is not always-enabled and does not request persistent elevated privileges. It writes temporary HTML/PNG files per run and instructs to delete them; that behavior is consistent with its purpose.
What to consider before installing
This skill appears to do what it says (turn HTML into long PNGs), but before installing or running it you should: 1) Ensure the agent environment has Python 3 and Playwright (and Chromium) installed from trusted sources — the repository does not declare these dependencies. 2) Be cautious with untrusted HTML: the renderer opens pages in a real browser and will fetch remote resources (images/CSS/JS) or follow file:// references; malicious or private content could be exfiltrated via network requests or cause unexpected behavior. 3) Confirm your runtime will auto-download browser binaries (Playwright behavior) or install them explicitly to avoid silent network downloads. 4) If you need stricter safety, run the renderer in a sandboxed environment, audit the HTML before rendering, and ensure temporary outputs are cleaned (SKILL.md recommends deleting them). If you want, I can: list exact installation steps for Playwright + Chromium, or propose a hardened invocation that disables network access during rendering.Like a lobster shell, security has layers — review code before you run it.
latestvk9724bjnyqtwj4xg9er03kxkn183vdpj
License
MIT-0
Free to use, modify, and redistribute. No attribution required.