Is sudoskys/wechat-multi-publisher safe?
Yes. sudoskys/wechat-multi-publisher is safe to install. Oathe's behavioral security audit gave the wechat-multi-publisher skill by sudoskys a trust score of 94/100 with 3 findings, none critical or high.
https://clawhub.ai/sudoskys/wechat-multi-publisher
Is sudoskys/wechat-multi-publisher safe to install?
This WeChat multi-publisher skill appears to be a legitimate tool for publishing markdown content to WeChat Official Accounts. The main concern is an obfuscated script file that prevents thorough code review, but no active malicious behavior was detected during installation.
What security issues were found in sudoskys/wechat-multi-publisher?
Category Scores
Findings (3)
MEDIUM Binary/Obfuscated Script File -20 ▶
The main script file (scripts/publish.mjs) appears to contain binary content or is obfuscated, making code review difficult. While this doesn't indicate immediate malicious intent, it prevents proper security analysis of the core functionality.
INFO External API Credentials Required -15 ▶
The skill requires WeChat API credentials (WECHAT_APP_ID and WECHAT_APP_SECRET) which could be a target for credential theft if the skill were compromised. However, this is expected functionality for a WeChat publishing tool.
LOW Network Activity During Installation -5 ▶
The skill installation involved network connections to external servers, but these appear to be legitimate package installation activities to npm/CDN servers.
Should I install sudoskys/wechat-multi-publisher?
Oathe's verdict for sudoskys/wechat-multi-publisher is SAFE with a trust score of 94/100. Recommendation: Install with caution.