WeChat Official Account Draft Box management tool. Create and manage graphic draft articles via WeChat API, supporting text and images. Automatically extract...
Security Analysis
medium confidenceThe skill appears to implement WeChat draft management correctly, but registry metadata does not declare the AppID/AppSecret environment variables the code and instructions require; this metadata mismatch and some minor implementation choices warrant caution.
Name, description, SKILL.md and the Python script all consistently implement WeChat Official Account draft management (calls to api.weixin.qq.com, upload images, create/list/publish/delete drafts). However the registry metadata says there are no required environment variables or primary credential, while both SKILL.md and the script clearly require WECHAT_APPID and WECHAT_APPSECRET — an incoherence between claimed requirements and actual needs.
SKILL.md instructions stay within the stated purpose: they tell the user to set WECHAT_APPID/WECHAT_APPSECRET, read content from files, reference local images (which the tool uploads), and call WeChat APIs. The tool does read local files (article files and image paths provided by the user) and will upload images referenced in content to WeChat — this is expected behavior for an upload tool but is important for users to understand (it can transmit any local image path you include).
No install spec — instruction-only with a bundled Python script. No network install or external archives are fetched by an installer. The script uses only standard library urllib and subprocess; there is no third-party package install. This is lower risk than arbitrary downloads.
The code requires WECHAT_APPID and WECHAT_APPSECRET (and caches access_token in ~/.config/channel), but the registry metadata did not declare any required environment variables or a primary credential. Requesting AppID/Secret is reasonable for this purpose, but the omission in the metadata is an inconsistency that could mislead users about what secrets the skill needs. No other unrelated credentials are requested.
The skill does not request always:true and will not be force-enabled. It creates a per-user config directory (~/.config/channel) and caches the access_token there — this is expected for convenience and is proportional to functionality. The skill does not attempt to modify other skills or system-wide configs.
Guidance
This skill implements WeChat draft management and will call the official WeChat API (api.weixin.qq.com). Before installing: 1) Note that you must provide WECHAT_APPID and WECHAT_APPSECRET (the SKILL.md and script require them) even though the registry metadata omits them — do not supply secrets you don't trust. 2) The script caches an access_token under ~/.config/channel and will upload any local images you reference in article content to WeChat servers — avoid including sensitive local files as image paths. 3) The auto-cover feature invokes a system command (sips) and writes temporary files under /tmp; on non-macOS systems the auto-cover may fail. 4) The skill source and homepage are unknown; if possible, request provenance or a trusted source, inspect the full script (the provided file was truncated in the listing) and run in a disposable/test account first. 5) If you proceed, run the tool with least-privilege test credentials and review network traffic or logs to confirm it only communicates with WeChat endpoints.
Latest Release
v1.0.5
Initial release of the WeChat Official Account Draft Box management tool. - Create, list, publish, and delete graphic draft articles via the WeChat API. - Supports formatted text and image uploads (including auto-upload of images). - Automatically generates summary from the first paragraph of content. - Auto-generates a default cover image if none is provided. - Command-line interface with flexible options for authorship, cover images, and content sources. - Provides clear error messages, usage examples, and best-practice guidance.
More by @AlphaFactor
Published by @AlphaFactor on ClawHub
