技能详情（站内镜像，无评论）
许可证：MIT-0
MIT-0 ·免费使用、修改和重新分发。无需归因。
版本：v1.0.0
统计：⭐ 0 · 34 · 0 current installs · 0 all-time installs
⭐ 0
安装量（当前） 0
🛡 VirusTotal ：可疑 · OpenClaw ：可疑
Package：achievejia/wechat-xhs-publisher
安全扫描（ClawHub）
- VirusTotal ：可疑
- OpenClaw ：可疑
OpenClaw 评估
The skill's described purpose (rewrite + publish to WeChat and Xiaohongshu) matches its instructions, but the SKILL.md expects external tools, network calls, and runtime package execution while the metadata declares no required binaries or credentials — that mismatch is concerning and needs clarification before use.
目的
The skill claims to publish to WeChat and Xiaohongshu and the instructions do that, but it delegates publishing to external tools (baoyu-post-to-wechat, mcporter) and an IP-checker skill. The registry metadata declares no required binaries or credentials, yet the runtime commands (npx, bun, mcporter, mcporter call, image API) clearly require specific tools and likely account credentials. The absence of declared requirements is an incoherence.
说明范围
Instructions are focused on the stated workflow: generate article, generate images, check public IP, then publish. They reference network endpoints (ip38.com and image APIs) and call other local/third-party tools. They instruct reading/writing workspace files (post-to-wechat/YYYY-MM-DD/, img/, {workspace}/wechat_ip_config.md) which is within the task's scope. However, they also instruct running npx -y bun scripts/wechat-api.ts (which will exec…
安装机制
There is no install spec (instruction-only), which is lower risk in principle, but the runtime relies on commands that will fetch/run code at execution (npx -y bun ...). Using npx -y invokes package download/execution from registries at runtime, which can execute arbitrary code. The skill does not declare required binaries (node/npx/bun/mcporter), so the metadata is inconsistent with the commanded runtime environment.
证书
The skill declares no required environment variables or primary credential, yet publishing to WeChat and Xiaohongshu will require authentication tokens/credentials handled by the referenced tools. That mismatch leaves it unclear how credentials are supplied and audited. The skill also reads a workspace config file for an IP whitelist — verify this file doesn't store other secrets. Network endpoints and image-generation APIs may require API key…
持久
The skill does not request always:true, does not modify other skills, and is instruction-only. It writes files into the workspace and invokes other tools, which is expected for a publishing workflow. Autonomous invocation is allowed by default but is not in itself a new risk here.
安装（复制给龙虾 AI）
将下方整段复制到龙虾中文库对话中，由龙虾按 SKILL.md 完成安装。
请把本段交给龙虾中文库（龙虾 AI）执行：为本机安装 OpenClaw 技能「Wechat Xhs Publisher」。简介：微信公众号与小红书一键发布工具。当需要将热点新闻改写成公众号文章并发布到微信公众号和小红书时使用，包括：1)根据热点新闻改写公众号文章 2)使用AI生成文章配…。
请 fetch 以下地址读取 SKILL.md 并按文档完成安装：https://raw.githubusercontent.com/openclaw/skills/refs/heads/main/skills/achievejia/wechat-xhs-publisher/SKILL.md
（来源：yingzhi8.cn 技能库）SKILL.md
暂无本地缓存内容，可在后台执行详情同步。