Notification integrations can mishandle recipients, credentials, retries, and delivery results. This skill guides WxPusher implementation and troubleshooting using project conventions, documented API behavior, and mock tests.
Review the Skillstore skill "wxpusher-integration" from https://skillstore.io/skills/hunxuankai-wxpusher-integration.md and its manifest at https://skillstore.io/api/skills/hunxuankai-wxpusher-integration/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.
All 24 static findings are false positives involving documented endpoints, placeholder configuration, Markdown syntax, installation paths, and readable Chinese text. No evidence found of prompt injection, credential exfiltration, concealed execution, or unauthorized messaging. The skill requires scoped authorization for live pushes, prefers POST, and documents credential redaction and service limitations.
hunxuankai. (2026). wxpusher-integration security audit report (audit version 2) [Author version 1.0.4]. Skillstore. https://skillstore.io/skills/hunxuankai-wxpusher-integration/audits/2
BibTeX ์ธ์ฉ
@techreport{hunxuankai-hunxuankai-wxpusher-integration-2026,
author = {hunxuankai},
title = {wxpusher-integration security audit report (audit version 2)},
institution = {Skillstore},
year = {2026},
number = {2},
url = {https://skillstore.io/skills/hunxuankai-wxpusher-integration/audits/2},
note = {Author version 1.0.4}
}
CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "wxpusher-integration security audit report (audit version 2)"
version: "1.0.4"
type: report
authors:
- name: "hunxuankai"
date-released: "2026-10-18"
url: "https://skillstore.io/skills/hunxuankai-wxpusher-integration/audits/2"
identifiers:
- type: other
value: "skillstore:hunxuankai-wxpusher-integration:audit:2"
description: "Skillstore immutable audit report identifier"
Skillstore ์ ์
์ด ์ ์์ ์ด์ ์ฆ๊ฑฐ ์ ๋ขฐ๋: ์ค๊ฐ
45
์ํคํ ์ฒ
100
์ ์ง๋ณด์์ฑ
87
์ฝํ ์ธ
65
์ปค๋ฎค๋ํฐ
91
์ฌ์ ์ค์
๋ง๋ค ์ ์๋ ๊ฒ
Report scheduled task failures
Add WxPusher failure alerts to an existing script with minimal configuration, bounded retries, and mock validation.
Integrate backend event notifications
Extend an existing notification service with recipient routing, partial-failure handling, and duplicate prevention.
Diagnose deployment alert delivery
Review protected CI secrets, response codes, subscriber settings, and channel restrictions without automatically sending live messages.
์ด ํ๋กฌํํธ๋ฅผ ์ฌ์ฉํด ๋ณด์ธ์
Understand WxPusher setup
I have selected WxPusher for a personal script. Explain standard POST versus SPT, required configuration, and recipient prerequisites without sending messages.
Add task notifications
Add WxPusher failure notifications to this Python task using existing project conventions. Use placeholder configuration and mock tests; do not send live messages.
Investigate missing WeChat notifications
WxPusher accepts my messages, but WeChat receives nothing. Review redacted responses, recipient results, ClawBot binding, activation, and limits without live pushes.
Design resilient queue delivery
Integrate WxPusher into our existing queue worker with per-target validation, bounded retries, deduplication, redacted logs, and mock failure tests. Preserve primary business outcomes.
๋ชจ๋ฒ ์ฌ๋ก
Reuse project configuration, HTTP clients, and notification interfaces; keep credentials in approved secret storage.
Prefer JSON POST, redact logs, and check both top-level and individual recipient business results.
Validate with mocks first; send live messages only within explicit authorization for recipients, purpose, and frequency.
ํผํ๊ธฐ
Treating HTTP 200 or task creation as proof that every recipient received or read the notification.
Committing credentials, logging full authenticated URLs, or copying personal data into notification bodies.
Retrying indefinitely, defaulting to broadcast when recipients are missing, or assuming an SPT can be revoked by rescanning.
์์ฃผ ๋ฌป๋ ์ง๋ฌธ
Can I use this skill with Claude, Codex, and Claude Code?
Yes. The core workflow is documentation-based and uses available project tools rather than a required host-specific integration.
Does the skill include a ready-to-run notification client?
No. It provides instructions and references for implementing WxPusher through your existing language, HTTP client, configuration, and testing tools.
What configuration do standard pushes require?
Standard pushes require an appToken, message content, and UID or Topic targets. SPT uses a separate token-based mode.
Will development tests send real notifications?
No, not by default. Development uses mocks; live pushes require explicit authorization covering the intended recipients, purpose, and frequency.
Can WxPusher send to any WeChat friend or group?
No. The documented ClawBot channel requires user binding and activation, supports text notifications, and has channel-specific limits.
How should I handle a leaked SPT?
Stop sharing it and clean controlled copies. Public references do not verify revocation; contact WxPusher and do not assume rescanning invalidates it.