中文 EN

扫描报告

扫描新文件

✓ 可信 — 风险评分 5/100
上次扫描：2 天前 重新扫描
5 /100
wechat-typeset-pro
微信公众号专业排版技能 — Markdown to WeChat-compatible inline-style HTML with 30 themes, gallery preview, and optional draft publishing
WeChat public account Markdown formatting tool with fully declared filesystem writes, shell subprocess calls, and WeChat API network access — all necessary and appropriate for its stated purpose.
技能名称wechat-typeset-pro
分析耗时35.9s
引擎pi
✓
可以安装
Skill is safe to use. No action required.

安全发现 3 项

严重性 安全发现 位置
低危
Output directory hardcoded in config.json
config.json contains vault_root=/Users/yaohua.liu and output_dir=~/WorkBuddy/wechat-typeset-pro. The vault_root is used to search for Obsidian wiki-link images. This is clearly scoped and appropriate for a content formatting tool.
"vault_root": "/Users/yaohua.liu"
→ No action needed. This path is used only for optional image resolution and matches the skill's legitimate purpose.
 config.json:3
低危
config.json marked sensitive by pre-scan
config.json was flagged as sensitive. Review shows it contains only configuration values (paths, theme settings) with empty WeChat credential fields — credentials are correctly loaded from ~/.openclaw/.env. No actual secrets are stored.
"wechat": { "app_id": "", "app_secret": "", "author": "" }
→ No action needed. Secrets are not stored in config.json.
 config.json:1
提示
No dependency version pinning
requirements.txt / package.json absent; dependencies (markdown, requests, dotenv) are imported without pinned versions. This is a supply-chain hygiene issue rather than a security vulnerability.
import markdown, requests, dotenv
→ Consider adding a requirements.txt with pinned versions for reproducibility.
 N/A
资源类型声明权限推断权限状态证据
文件系统 WRITE WRITE ✓ 一致 SKILL.md scripts/format.py & scripts/publish.py shell commands
命令执行 WRITE WRITE ✓ 一致 scripts/publish.py:339 — subprocess.run(format_cmd)
网络访问 READ READ ✓ 一致 scripts/publish.py:76-241 — WeChat API calls to api.weixin.qq.com
浏览器 READ READ ✓ 一致 scripts/format.py — webbrowser.open() for gallery preview
环境变量 READ READ ✓ 一致 scripts/publish.py:36-43 — reads WECHAT_APP_ID/SECRET from env
技能调用 WRITE WRITE ✓ 一致 SKILL.md:format.py + publish.py script orchestration
4 项发现
🔗
中危 外部 URL 外部 URL
https://api.weixin.qq.com/cgi-bin/token
scripts/publish.py:76
🔗
中危 外部 URL 外部 URL
https://api.weixin.qq.com/cgi-bin/material/add_material
scripts/publish.py:99
🔗
中危 外部 URL 外部 URL
https://api.weixin.qq.com/cgi-bin/media/uploadimg?access_token=
scripts/publish.py:127
🔗
中危 外部 URL 外部 URL
https://api.weixin.qq.com/cgi-bin/draft/add?access_token=
scripts/publish.py:241

目录结构

36 文件 · 359.7 KB · 13211 行
JSON 31f · 10028L Python 2f · 2233L HTML 2f · 704L Markdown 1f · 246L
├─ ▾ 📁 scripts
│ ├─ 🐍 format.py Python 1763L · 67.9 KB
│ └─ 🐍 publish.py Python 470L · 17.7 KB
├─ ▾ 📁 templates
│ ├─ 📄 gallery.html HTML 435L · 10.9 KB
│ └─ 📄 preview.html HTML 269L · 7.0 KB
├─ ▾ 📁 themes
│ ├─ 📋 bauhaus.json JSON 351L · 8.7 KB
│ ├─ 📋 bold-blue.json JSON 337L · 8.4 KB
│ ├─ 📋 bold-green.json JSON 337L · 8.4 KB
│ ├─ 📋 bold-navy.json JSON 337L · 8.4 KB
│ ├─ 📋 bytedance.json JSON 345L · 8.9 KB
│ ├─ 📋 chinese.json JSON 339L · 8.4 KB
│ ├─ 📋 coffee-house.json JSON 334L · 8.4 KB
│ ├─ 📋 elegant-blue.json JSON 335L · 8.3 KB
│ ├─ 📋 elegant-green.json JSON 335L · 8.3 KB
│ ├─ 📋 elegant-navy.json JSON 335L · 8.3 KB
│ ├─ 📋 focus-blue.json JSON 335L · 8.5 KB
│ ├─ 📋 focus-gold.json JSON 335L · 8.5 KB
│ ├─ 📋 focus-red.json JSON 335L · 8.5 KB
│ ├─ 📋 github.json JSON 335L · 8.3 KB
│ ├─ 📋 ink.json JSON 328L · 7.7 KB
│ ├─ 📋 lavender-dream.json JSON 333L · 8.4 KB
│ ├─ 📋 magazine.json JSON 332L · 8.3 KB
│ ├─ 📋 midnight.json JSON 340L · 9.0 KB
│ ├─ 📋 minimal-blue.json JSON 319L · 7.5 KB
│ ├─ 📋 minimal-gold.json JSON 319L · 7.5 KB
│ ├─ 📋 minimal-gray.json JSON 319L · 7.5 KB
│ ├─ 📋 minimal-navy.json JSON 319L · 7.5 KB
│ ├─ 📋 minimal-red.json JSON 319L · 7.5 KB
│ ├─ 📋 mint-fresh.json JSON 337L · 8.5 KB
│ ├─ 📋 newspaper.json JSON 340L · 8.3 KB
│ ├─ 📋 sports.json JSON 340L · 8.7 KB
│ ├─ 📋 sspai.json JSON 336L · 8.3 KB
│ ├─ 📋 sunset-amber.json JSON 335L · 8.5 KB
│ ├─ 📋 terracotta.json JSON 334L · 8.1 KB
│ └─ 📋 wechat-native.json JSON 335L · 8.4 KB
├─ 🔑 config.json ⚠ JSON 18L · 390 B
└─ 📝 SKILL.md Markdown 246L · 7.7 KB

依赖分析 3 项

包名版本来源已知漏洞备注
markdown * import 否 No requirements.txt; version not pinned
requests * import 否 No requirements.txt; version not pinned
dotenv * import 否 No requirements.txt; version not pinned

安全亮点

✓ WeChat credentials are loaded from environment variables (~/.openclaw/.env), not hardcoded in config.json
✓ SKILL.md fully documents all scripts, parameters, and credential requirements
✓ Subprocess calls are explicitly declared as part of the workflow (format.py → publish.py chain)
✓ All network requests go to official WeChat API domain (api.weixin.qq.com) — no third-party exfiltration
✓ No base64/eval/obfuscation patterns found in any Python script
✓ No access to sensitive paths such as ~/.ssh, ~/.aws, .env files
✓ File operations are scoped to user-provided input files and configured output directories
✓ No hidden functionality detected — all HTML containers, callout syntax, and gallery features are documented in SKILL.md