wechat-writer
Pass
Audited by Gen Agent Trust Hub on Apr 3, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns detected. The skill is designed for high-quality content creation and follows security best practices.
- [COMMAND_EXECUTION]: The skill utilizes several Python scripts (
generate_images.py,publish_wechat.py,originality_quality_gate.py) and a Bash script (sync-to-local.sh) to handle automation. These scripts perform well-defined tasks such as image generation, formatting, quality checking, and local file synchronization, all within the scope of the skill's functionality. - [EXTERNAL_DOWNLOADS]: Network operations are directed at official and documented endpoints. The skill interacts with the official WeChat API (
api.weixin.qq.com) for content publishing and a specific third-party AI service (yunwu.ai) for image generation. These operations are required for the skill's stated features. - [DATA_EXFILTRATION]: Although the skill manages WeChat credentials (
appidandappsecret), it implements robust security measures. It uses local-only configuration files (*.local.yaml), provides clear instructions to avoid committing secrets to version control, and includes logic to mask sensitive tokens in conversation logs. No unauthorized data transmission was identified. - [PROMPT_INJECTION]: The skill uses detailed instructions to define a 'writing persona' and 'evolution mechanism.' These are creative constraints meant to improve writing quality and consistency, not attempts to bypass the safety protocols of the underlying AI model.
Audit Metadata