multi-writing-skills
v1.1.3支持将 Markdown 文章转换并一键发布到微信公众号、知乎、今日头条，含代码格式优化、AI写作与封面图生成。
⭐ 2· 168·0 current·0 all-time
by@yuesf
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (publish Markdown to WeChat/Zhihu/Toutiao, AI writing, image gen) match the code and CLI: converters, platform adapters, AI/image provider modules, and config keys for AppID/Secrets and cookies are all expected for those features.
Instruction Scope
SKILL.md and the CLI describe converting and publishing Markdown and using AI/image providers. The runtime instructions and code will read/write a local config (~/.multi-writing-skills/config.yaml), optionally load ~/.openclaw/.env, and send content to external services (mdnice, OpenAI, Anthropic, Gemini, ModelScope, or custom API endpoints). These behaviors are within the claimed scope but do involve sending article content (and any configured credentials) to third-party endpoints.
Install Mechanism
No install spec provided (instruction-only in registry), so nothing is downloaded or executed by an installer. The package contains Python code that will run in the agent environment if invoked, which is expected for a skill with code files.
Credentials
The manifest lists no required env vars, but the code accepts/reads many environment variables and config keys (WECHAT_APP_ID/WECHAT_APP_SECRET, ZHIHU_COOKIE, TOUTIAO_COOKIE, AI_API_KEY, AI_PROVIDER, AI_BASE_URL, AI_MODEL). Those map directly to the functionality (platform auth and AI providers) and are proportionate — but they are sensitive (cookies and API keys). The skill also optionally loads ~/.openclaw/.env to pick up env vars in that directory, which could expose other local env settings if present.
Persistence & Privilege
Skill is not always:true and uses normal autonomous invocation defaults. It writes its own config under ~/.multi-writing-skills (expected). It does not appear to modify other skills or request system-wide privileged access.
Assessment
This skill appears to do what it claims, but it requires sensitive credentials to publish: WeChat AppID/Secret or platform cookies for Zhihu/Toutiao, and optional AI/image provider API keys. Before installing or using it: (1) prefer using platform API credentials when possible rather than copying full browser cookies; (2) review and control which AI/image provider API keys you configure (these will be sent to the provider endpoints); (3) be aware the tool may send article content to third-party conversion/AI endpoints (mdnice, OpenAI, Anthropic, Gemini, ModelScope or any custom endpoint you configure); (4) check the created config file (~/.multi-writing-skills/config.yaml) and ~/.openclaw/.env (if present) for stored secrets and remove anything you don't want retained; (5) if you need offline-only use, avoid enabling --api or --ai modes and prefer local conversion themes. If you want additional assurance, request the full contents of the image provider and platform modules to audit exactly which endpoints and fields are transmitted.Like a lobster shell, security has layers — review code before you run it.
latestvk97ft9vd4w141kb6rejz194dgn83xccc
License
MIT-0
Free to use, modify, and redistribute. No attribution required.