Real Skill packageSource verifiedClawHub registry

Wechat Native Publisher

把定稿的纯文本/md/已排版HTML，一键渲染成微信原生富文本并推送到公众号草稿箱。支持自动排版和HTML直输两种模式，含主题换肤、排版偏好向导、封面自动生成、发布前自检。

Identity and source

Publisher attributionBlack_Amicoregistry owner unverified by skillvetai
Functional categoryAwaiting category reviewreview pending · 0% rule confidence
Package forminstruction with code16 recorded files
Canonical sourceClawHub registryclawhub:zhouq2039-lang:wechat-native-publisher
Open canonical source ↗

Platform declarations

These states come from the source or distribution context. None of the entries below are SkillVetAI compatibility test results.

OpenClawnative officialProvenance: registry distribution

Independent structural checks

These checks parse the fixed package against dated platform rules. They do not execute the Skill or verify task behavior.

Claude Codeissues found
Checker 0.1.0 · agent-skills-2026-08-13+claude-code-docs-2026-08-13 · 9/9/2026.claude/skills/<skill-name>
1 structural issue
  • error: Portable Agent Skills require a non-empty name. SKILL.md

Runtime, accounts, dependencies, permissions, network behavior and task quality remain untested.

OpenAI Codexissues found
Checker 0.1.0 · agent-skills-2026-08-13+codex-docs-2026-08-13 · 9/9/2026.agents/skills/<skill-name>
1 structural issue
  • error: Portable Agent Skills require a non-empty name. SKILL.md

Runtime, accounts, dependencies, permissions, network behavior and task quality remain untested.

OpenClawissues found
Checker 0.1.0 · agent-skills-2026-08-13+openclaw-docs-2026-08-13 · 9/9/2026skills/<skill-name>
1 structural issue
  • error: Portable Agent Skills require a non-empty name. SKILL.md

Runtime, accounts, dependencies, permissions, network behavior and task quality remain untested.

Installation and inspection

This command is recorded from the source ecosystem and resolves the registry's latest release. The fixed release shown on this page should be inspected before adoption.

clawhub install @zhouq2039-lang/wechat-native-publisher
clawhub inspect @zhouq2039-lang/wechat-native-publisher --version 1.0.5

Security evidence

SkillVetAI static result: medium signal

This automated, non-executing scan is bound to this release hash. It is not a safety certification and may contain false positives or false negatives.

Status
completed
Coverage
full text content
Files
16 / 16 inspected as text
Checked
9/9/2026, 4:39:59 AM
Scanner
0.1.3
Policy
1.0.3
1 automated finding
mediumSKILL.md is missing name or description metadataSKILL.md:1 · confidence 100%required metadata missing
6 inferred permission indicators
  • shell execution — automatically inferred
  • network access — automatically inferred
  • filesystem read — automatically inferred
  • filesystem write — automatically inferred
  • credential access — automatically inferred
  • external write action — automatically inferred
3 dependency and API indicators
  • api: api.weixin.qq.com
  • api: clawhub.ai
  • api: mp.weixin.qq.com
External clawhub result: clean

This is registry-supplied evidence for the recorded release, not an independent SkillVetAI scan. Check the canonical source for the full report, scanner versions, scope, and current moderation state.

Evidence checked
9/9/2026, 2:51:13 AM
Release binding
Matches this record
  • vt: clean
  • skillspector: suspicious
  • llm: clean

Recorded files

The catalog stores hashes and an inventory summary for change detection. It does not republish the package contents.

Package content hashsha256:056dae6a96dd5771e60ba996cd3b582d71624ecbc28e0caa56eb038ce86b73b1
Show up to 16 recorded paths
  • examples/sample_html.html
  • examples/sample.md
  • references/wechat-whitelist.md
  • scripts/init_profile.py
  • scripts/make_cover.py
  • scripts/make_preview.py
  • scripts/md2render.py
  • scripts/profile.py
  • scripts/push_draft.py
  • scripts/renderer.py
  • scripts/theme.py
  • scripts/themes.json
  • scripts/validate.py
  • scripts/wx_api.py
  • skill-card.md
  • SKILL.md

Source changelog

**重大安全修复：通过 ClawHub 审计，消除 3 项安全告警，进一步提升排版/消毒/图片安全边界** - 全面收敛HTML转义边界，renderer组件内部自动转义标题和签名，防止XSS，无重复转义。 - 强化HTML消毒，所有URL属性严格校验scheme，仅允许http/https（img支持data:image），杜绝编码绕过和危险scheme注入。 - SSRF防护完善，彻底禁用requests环境代理，所有请求仅走校验过的真实公网IP。 - 同步修订消毒及渲染路径，配合腾讯 A.I.G ClawHub 安全审计意见。

Release security diff

mediumCompared fixed releases 1.0.4 and 1.0.5; 0 finding and 0 permission indicators were added.

Both fixed releases were scanned under the current scanner and policy, so finding, permission and dependency changes are available.

Change reasons and limitations
  • content hash changed

Observed release history

These older immutable releases were observed by prior successful syncs. They remain recorded when a newer release becomes current.

1.0.49/8/2026sha256:efae406ba5cb1b925221d084ec124c22b191431d0dfd31efea8e58b0219a8f13