wechat-article-pipeline

SUSPICIOUS: the skill is broadly coherent for WeChat article rendering and draft storage, and it explicitly blocks mass-send, but it routes content, account checks, image generation, and publishing through doubaoya.com using a service API key tied to the user's WeChat binding. That third-party credential/data flow and the transitive skills update path make it medium risk despite a mostly aligned purpose.

This module is primarily a credential-verification CLI: it legitimately reads DOUBAOYA API keys from local stores and validates them by sending each key to a remote /api/agent/whoami endpoint as an Authorization Bearer token, then uses the response to select the correct account. The main security concern is not hidden malware, but the sensitivity of the credential-to-network flow and the ability to influence the destination origin via --base-url/DOUBAOYA_BASE_URL, which could turn the tool into an exfiltration mechanism if misconfigured or tampered with. No explicit backdoor/obfuscation/persistence behaviors are evident in the provided code fragment.