lov-publish-wechat-article

SUSPICIOUS: the skill’s publishing purpose is coherent, but its actual footprint is broader than a normal WeChat publisher because it sends all API traffic through a LovStudio gateway, requires an extra gateway credential, and uses a private web API via a logged-in browser session. This is not confirmed malware, but the data-flow and credential-routing model creates high trust and interception risk.

No clear malware/backdoor is evident in this module (no eval/exec/subprocess/persistence). However, the module has two significant security risks: it dynamically executes an operator-supplied env-management script to obtain secrets, and it can upload arbitrary local image files referenced by markdown/lovpen HTML to a remote gateway (allowing potential local file data exfiltration if inputs are attacker-influenced). This should be reviewed/locked down in a hardened supply-chain/threat model.

No clear evidence of traditional malware (no obfuscation, no persistence, no system command execution, no exfiltration to unknown domains). However, the code is high-impact authenticated automation: it uses a live logged-in browser session (token/appmsgid) and performs credentialed POST requests to WeChat’s operate_appmsg endpoint to modify and verify article “original rights” state, and it broad-submits many input fields. If this were placed in an unexpected dependency chain, it could be abused to manipulate account content. Overall: low confidence of outright malicious malware, but meaningful security/abuse risk due to authenticated web modification capabilities.