Scan Report
5 /100
wechat-style-publisher
多账号微信公众号文章发布工具，支持主题化HTML和模板变量
Legitimate WeChat Official Account article publishing tool with no malicious behavior detected.
Safe to install
No action required. The skill performs standard WeChat API operations for article publishing.
| Resource | Declared | Inferred | Status | Evidence |
|---|---|---|---|---|
| Filesystem | READ | WRITE | ✓ Aligned | set-config.mjs writes to config files; apply-style.mjs writes output HTML |
| Network | READ | READ | ✓ Aligned | All network calls go to official WeChat API (api.weixin.qq.com) |
| Shell | NONE | NONE | — | No subprocess, exec, or shell command execution found |
1 findings
Medium External URL 外部 URL
https://api.weixin.qq.com assets/config.example.json:4 File Tree
15 files · 75.6 KB · 1661 lines JavaScript 5f · 937L
Python 2f · 555L
JSON 3f · 75L
Markdown 1f · 49L
CSS 1f · 36L
HTML 2f · 8L
Text 1f · 1L
├─
▾
assets
│ ├─
▾
templates
│ │ ├─
intro.html
HTML
│ │ └─
outro.html
HTML
│ ├─
config.example.json
JSON
│ ├─
custom-overrides.css
CSS
│ └─
template-variables.example.json
JSON
├─
▾
lib
│ └─
style.mjs
JavaScript
├─
▾
scripts
│ ├─
apply-style.mjs
JavaScript
│ ├─
import-template-node.mjs
JavaScript
│ ├─
import-template-python.py
Python
│ ├─
publish-node.mjs
JavaScript
│ ├─
publish-python.py
Python
│ └─
set-config.mjs
JavaScript
├─
package.json
JSON
├─
requirements.txt
Text
└─
SKILL.md
Markdown
Dependencies 3 items
| Package | Version | Source | Known Vulns | Notes |
|---|---|---|---|---|
highlight.js | ^11.11.1 | npm | No | Caret range - accepts minor updates |
juice | ^11.0.3 | npm | No | Caret range - accepts minor updates |
httpx | >=0.27,<1 | pip | No | Version range without upper bound pinning |
Security Positives
✓ All network traffic goes to official WeChat API endpoints
✓ No credential exfiltration - appId/appSecret used only for WeChat API authentication
✓ No obfuscated code or base64-encoded payloads
✓ No subprocess/shell execution patterns
✓ No access to sensitive paths (~/.ssh, ~/.aws, .env)
✓ Clean codebase with no hidden functionality
✓ Token caching is local-only and within expected scope
✓ Dependencies (highlight.js, juice, httpx) are well-known legitimate libraries