微信公众号自动发文一站式技能。组合 内容策划 + 人性化润色 + 自动创建草稿，一条龙生成公众号文章保存到草稿箱。Use when user needs to write 公众号文章、微信公众号、create wechat public account article, auto save to draft。
Security Analysis
high confidenceThe skill's description (auto-create WeChat drafts) is plausible, but the package metadata, runtime instructions, and included code don't line up and the bundled license logic talks to an unencrypted IP-based server and collects machine identifiers — this mismatch and insecure network behavior are concerning.
The SKILL.md promises end-to-end WeChat draft creation (requires WECHAT_APPID/WECHAT_APPSECRET), which is coherent for the stated purpose. However the registry metadata lists no required env vars or credentials (mismatch). The included Python code contains only a license gate and no implementation that interacts with the WeChat API or uploads media/creates drafts — so the package does not contain the core capability it claims to provide.
Runtime instructions instruct users to run the provided script to activate a license and mention using WECHAT_APPID/WECHAT_APPSECRET and IP whitelisting. The license flow prompts for a card key and will POST the key and a machine fingerprint to a remote license server. The SKILL.md does disclose '联网验证' and a default license server, but there are no runtime instructions or code in the package that actually perform the promised draft creation; the instructions give the agent or user wide discretion (rely on external 'humanizer' and other capabilities not included).
There is no installer — the skill is instruction-only and includes two Python scripts. No third-party packages are pulled during install. This is lower risk in terms of arbitrary downloads, but the bundled scripts perform network calls at runtime (license server), which introduces runtime risk.
SKILL.md declares that WECHAT_APPID and WECHAT_APPSECRET are required; that is proportionate to the claimed WeChat-draft capability. However the registry metadata lists no required env vars (incoherent). The license code also reads TMO_LICENSE_SERVER from the environment, and the license flow collects machine identifiers and a card key and transmits them over plain HTTP to a default IP — that is sensitive and not clearly justified beyond commercial license checking.
always:false and disable-model-invocation default are fine. The skill writes a local license file (license/license.json) to persist activation state — expected for commercial licensing. It does not request system-wide privileges or attempt to modify other skills' config.
Guidance
This package looks like a paid "WeChat auto-draft" skill, but there are several red flags you should consider before using it: (1) The registry metadata does not list the WECHAT_APPID/WECHAT_APPSECRET the SKILL.md says are required — ask the publisher to correct metadata. (2) The included code contains only a license gate; there is no code here that actually calls WeChat APIs to create drafts — request the source or proof of the actual draft-creation implementation. (3) The license activation contacts a default IP address over plain HTTP and will send your card key and a machine fingerprint in cleartext — this is insecure. Only provide real secrets or card keys if you trust the vendor and the transport is secure (HTTPS) or you can use a self-hosted license server. (4) If you decide to test it, run it in an isolated environment and do not use real WECHAT_APPSECRET or production account credentials until you have audited the code and confirmed secure transport and the presence of legitimate WeChat API calls. (5) Ask the author for a trustworthy homepage or repository, a TLS-protected license server, and a transparent explanation of where WeChat integration is implemented; without that, treat the package as untrusted.
Latest Release
v1.0.2
联网验证 + 购买卡密信息
More by @chenjiahui11
Published by @chenjiahui11 on ClawHub
