wechat-writer

Pass

Audited by Gen Agent Trust Hub on Apr 3, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: No malicious patterns detected. The skill is designed for high-quality content creation and follows security best practices.
  • [COMMAND_EXECUTION]: The skill utilizes several Python scripts (generate_images.py, publish_wechat.py, originality_quality_gate.py) and a Bash script (sync-to-local.sh) to handle automation. These scripts perform well-defined tasks such as image generation, formatting, quality checking, and local file synchronization, all within the scope of the skill's functionality.
  • [EXTERNAL_DOWNLOADS]: Network operations are directed at official and documented endpoints. The skill interacts with the official WeChat API (api.weixin.qq.com) for content publishing and a specific third-party AI service (yunwu.ai) for image generation. These operations are required for the skill's stated features.
  • [DATA_EXFILTRATION]: Although the skill manages WeChat credentials (appid and appsecret), it implements robust security measures. It uses local-only configuration files (*.local.yaml), provides clear instructions to avoid committing secrets to version control, and includes logic to mask sensitive tokens in conversation logs. No unauthorized data transmission was identified.
  • [PROMPT_INJECTION]: The skill uses detailed instructions to define a 'writing persona' and 'evolution mechanism.' These are creative constraints meant to improve writing quality and consistency, not attempts to bypass the safety protocols of the underlying AI model.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 3, 2026, 03:14 PM