wechat-draft-publish
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/preprocess-and-publish.mjsutilizesnode:child_process.spawnSyncto call the macOSsipsutility. This is used for image compression and format conversion to comply with WeChat's 1MB file size limit for draft images. - [EXTERNAL_DOWNLOADS]: The skill performs network operations to
https://doubaoya.comfor account status checks, image uploads, and draft publishing. These interactions are core to the skill's functionality and use standard HTTP methods with authorization headers. - [CREDENTIALS_SAFE]: The skill correctly instructs users to manage sensitive API keys (
DOUBAOYA_API_KEY) via environment variables rather than hardcoding them, which aligns with security best practices.
Audit Metadata