wechat-hotspot-publisher

SUSPICIOUS. 该技能的内容生成、图片搜索、官方微信草稿箱发布与用途基本一致，但其“推荐”微信发布路径把完整文章发送到不可验证的第三方裸IP明文HTTP接口，数据流与官方API不一致。小红书和B站又要求完整浏览器Cookie并绕过官方开放平台授权，权限范围和凭证处理都偏重。整体不是确认恶意代码，但对凭证与内容路由的设计明显超出稳妥边界。

No direct signs of intentional malware (no exec/eval, no persistence, no system command execution, no covert data theft) are present in the provided module. However, the module materially increases security/privacy exposure: it can download arbitrary remote URLs for covers (user-controlled egress), forwards user-provided article content/metadata to a configurable external HTTP endpoint (default non-TLS), embeds an access token in URL query strings, and prints full JSON responses to stdout. Additionally, the non-standard `coze_workload_identity.requests` import is a supply-chain auditing hotspot. Treat this as a medium-to-high integration risk rather than overtly malicious code.