wjs-publishing-wechat

SUSPICIOUS：该技能的核心目的与微信公众号写作/发布基本一致，但它的实际足迹超出单纯写作，涉及读取本地会话凭据、自动上传到微信后台、自动 git push，并把图像生成委托给第三方 skill 且使用 Codex 凭据。未见明显凭据外传到已知窃取端点，也未见隐藏执行或恶意载荷，因此不像确认恶意；但传递信任链和凭据转发使其整体风险中等偏高。

The code appears to be a legitimate WeChat comment-fetching utility rather than malware. Its critical security weakness is that an attacker-controlled --url causes the authenticated Cookie header to be sent to that URL, enabling session-cookie theft. Users should restrict the URL to the intended mp.weixin.qq.com endpoint, avoid passing cookies on the command line, and escape untrusted content before rendering Markdown.