微排版

• Risk level: Low
• Analyzed: Apr 29, 2026, 3:07 AM
• Findings: 0
• Version: 1.2.0

Overview

The skill's requirements and runtime instructions are consistent with its stated purpose (automating WeChat article creation via the weipaiban service); optional image-generation dependencies are clearly optional and gated behind user consent.

This skill appears internally consistent with its purpose. Before installing/using: (1) Only provide WEIPAIBAN_API_KEY to enable the core functionality; prefer creating a scoped API key if the service supports it. (2) If you want image generation, provide VOLCENGINE_* only when needed and prefer temporary STS tokens over long-lived keys. (3) The skill may download a ~4.7MB rembg model (~/.u2net/u2netp.onnx) if you enable background removal; rembg installation is only performed after you explicitly confirm the shown commands. (4) Generated images and any replacements are uploaded to the weipaiban CDN — review the privacy/terms of both weipaiban.cn and any image-generation provider (jimeng/火山引擎) before uploading sensitive content. (5) Small metadata inconsistency: WEIPAIBAN_API_BASE is referenced in the docs but not declared in the manifest optionalEnv — confirm with the publisher or treat WEIPAIBAN_API_BASE as an optional override if you need a custom API endpoint. (6) If you want extra safety, run the skill in a sandbox/container and clean the /tmp/weipaiban-task-* directories and ~/.u2net/ after use.