微信公众号自动发布
v1.0.0自动登录微信公众号，自动填写标题正文，生成并设置AI封面图，支持草稿保存、摘要留言赞赏配置，提升发布效率。
⭐ 2· 197·2 current·2 all-time
byDecleorMX@xiebbs
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description match the implementation: publish.py uses Playwright to log into mp.weixin.qq.com, fill title/content, trigger AI 配图、抓取图片 URL、裁剪并发布或保存草稿. 没有请求与公众号发布无关的外部 credentials、服务或 binaries.
Instruction Scope
SKILL.md and publish.py stay within the stated publishing task. Minor inconsistency: documentation suggests auxiliary scripts (inspect_*.py) for DOM inspection but such helper file is not present in the package. The instructions read/write cookies (~/.wechat_mp/cookies.json) and write debug screenshots to /tmp — these are expected for automation but are data collection points to be aware of.
Install Mechanism
No install spec in the package (instruction-only + a requirements.txt). It requires Playwright which will typically download browser binaries at install/runtime; that is heavyweight but expected for browser automation. No downloads from unknown personal servers are present in the package metadata.
Credentials
The skill does not request environment variables or external secrets. It stores and reuses session cookies in ~/.wechat_mp/cookies.json (sensitive: contains authentication cookies for your WeChat MP account). That storage is proportional to the purpose but is sensitive and worth reviewing/deleting when not needed.
Persistence & Privilege
always:false and no special platform privileges. The skill writes only its own cookie file and temporary screenshots; it does not claim to modify other skills or global agent settings. Note: autonomous invocation is allowed by default — running the skill can publish to your account, so treat it as an action with side effects.
Assessment
What to consider before installing/running:
- Review the publish.py source yourself (it will control your WeChat public account via the browser). The package appears to do exactly that, but running it grants the script the ability to publish or save drafts on your behalf.
- The script saves login cookies to ~/.wechat_mp/cookies.json. Those cookies are equivalent to logged-in session tokens; keep that file private or delete it when not needed.
- Playwright will download browser binaries (large and network-accessed). If you have policies about external downloads, be aware.
- Test first with a non-production/test WeChat public account so you can confirm behavior (and avoid accidental publishes).
- The docs mention helper scripts (inspect_*.py) that are not included; be cautious if following troubleshooting steps that reference non-existent files.
- If you have concerns, run the script in an isolated environment (VM/container) and inspect network activity; remove cookie file after use if you want to revoke persistent login.Like a lobster shell, security has layers — review code before you run it.
latestvk9705mcra8j1kmf9vhq4s2ff45834ka1
License
MIT-0
Free to use, modify, and redistribute. No attribution required.