Is 0731coderlee-sudo/wechat-publisher safe?
Yes. 0731coderlee-sudo/wechat-publisher is safe to install. Oathe's behavioral security audit gave the wechat-publisher skill by 0731coderlee-sudo a trust score of 87/100 with 3 findings, none critical or high.
https://clawhub.ai/0731coderlee-sudo/wechat-publisher
Is 0731coderlee-sudo/wechat-publisher safe to install?
This skill appears to be a legitimate wrapper around wenyan-cli for publishing Markdown content to WeChat Official Accounts. The main security concern is the automatic global installation of npm packages, though this is for a legitimate tool.
What security issues were found in 0731coderlee-sudo/wechat-publisher?
Category Scores
Findings (3)
MEDIUM Global NPM Package Installation -25 ▶
The publish.sh script automatically installs @wenyan-md/cli globally via npm if not already present. While this is the legitimate tool the skill wraps, global package installation can pose security risks if the package or npm registry were compromised.
LOW Credential File Access -15 ▶
The skill reads WeChat API credentials from TOOLS.md file. This is legitimate for the skill's intended functionality but requires users to store sensitive credentials in a specific location.
LOW Hardcoded File Paths -10 ▶
The skill references specific hardcoded file paths in its documentation, which could potentially be used to influence agent behavior, though no malicious intent is apparent.
Should I install 0731coderlee-sudo/wechat-publisher?
Oathe's verdict for 0731coderlee-sudo/wechat-publisher is SAFE with a trust score of 87/100. Recommendation: Install with caution.