wechat-crawler — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited wechat-crawler (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Crawl WeChat official account articles, statistics and comments automatically.
Crawls articles from WeChat Official Accounts, along with their statistics (read count, likes, "Worth Reading" count, share count) and comment data.
wechat-crawler/
├── config.py # Configuration (database connection)
├── db_operations.py # Database operations module
├── cookie_utils.py # [New] Cookie format conversion utilities
├── crawler.py # Core crawler logic (new Cookie management workflow)
├── run_crawler.py # Entry point (supports CLI arguments)
├── debug_crawler.py # Debug script
├── requirements.txt # Dependencies
└── SKILL.md # This document┌─────────────────────────────────────────────────────────────┐
│ User provides browser Cookie │
│ --cookie-json / --cookie-domain / --cookie-str │
└─────────────────────────────────────────────────────────────┘
│
▼
┌─────────────────────────────────────────────────────────────┐
│ [Auto] Detect Cookie format → Convert to dict → Load into Session │
└─────────────────────────────────────────────────────────────┘
│
▼
┌─────────────────────────────────────────────────────────────┐
│ [Auto] Visit mp.weixin.qq.com to extract Token │
│ (No manual --token argument required) │
└─────────────────────────────────────────────────────────────┘
│
▼
┌─────────────────────────────────────────────────────────────┐
│ [Auto] Quick API availability validation │
│ Search for test keyword → Check API response code │
└─────────────────────────────────────────────────────────────┘
│
┌───────────────┴───────────────┐
│ │
Validation Passed Validation Failed
│ │
▼ ▼
┌─────────────────────────┐ ┌─────────────────────────────┐
│ Save Cookie to DB │ │ Prompt Cookie expired │
│ Reusable next time │ │ Guide user to obtain fresh │
└─────────────────────────┘ │ browser Cookie │
│ └─────────────────────────────┘
▼
┌─────────────────────────────────────────────────────────────┐
│ Start crawling (all Official Accounts) │
│ 1. Iterate over all enabled Official Accounts in crawl_tasks │
│ 2. Search for Official Account to obtain fakeid │
│ 3. Retrieve article list │
│ 4. Crawl each article: content + stats + comments │
│ 5. Save to database │
└─────────────────────────────────────────────────────────────┘Edit config.py:
DB_CONFIG = {
"host": "192.168.1.100",
"port": 3306,
"user": "root",
"password": "your_password",
"database": "webchat12",
"charset": "utf8mb4"
}pip install selenium beautifulsoup4 pymysql requests webdriver-manager#### ✨ Recommended: Provide Browser Cookie (Token auto‑extracted)
Only the cookie is needed – no manual token lookup:
# JSON format (exported from DevTools)
python3 run_crawler.py \
--cookie-json '[{"name":"uin","value":"xxx"},{"name":"key","value":"xxx"}]'
# Domain format (copy from Application panel, select all)
python3 run_crawler.py \
--cookie-domain "$(cat cookies.txt)"
# Cookie request header string format
python3 run_crawler.py \
--cookie-str 'uin=xxx; key=xxx; pass_ticket=xxx'
# Crawl a single Official Account
python3 run_crawler.py \
--cookie-str 'uin=xxx; key=xxx' \
"Midea"After providing the cookie, the system will automatically:
#### Method 2: Auto Mode (Check database cookie)
# Crawl all enabled Official Accounts
python3 run_crawler.py
# Crawl a specific Official Account
python3 run_crawler.py "Midea"
# If the database cookie has expired, you'll be prompted to provide a browser cookie. Follow the instructions and rerun.--cookie-domain argument.--cookie-json argument.home?t=home/index).--cookie-str argument.~~After logging in, copy the number after token= from the address bar~~ Starting from v2, the token is automatically extracted!
You only need to provide the browser cookie; the crawler will:
https://mp.weixin.qq.com/token= parameter from the final URL💡 If auto‑extraction fails, you can still manually specify --token 123456789 as a fallback.from crawler import WeChatCrawler
crawler = WeChatCrawler()
# Method 1: Start from browser cookie (recommended) – token auto‑extracted
browser_cookies_text = "..." # copied from browser
crawler.set_user_browser_cookies(browser_cookies_text)
# Or specify format:
crawler.set_user_browser_cookies(browser_cookies_text, format_type='header_str')
# Also supports manual token:
crawler.set_user_browser_cookies(browser_cookies_text, token='123456789')
# Method 2: Auto mode (checks database or prompts user)
crawler.run()
# Method 3: Crawl a specific Official Account
crawler.get_content("Official Account name")from db_operations import WeChatDB
db = WeChatDB()
# Check if a cookie exists
db.has_cookie() # True/False
# Get the latest valid cookie
cookies, token = db.get_latest_valid_cookie()
# Save cookie
db.save_cookie(cookies, token)
# Add a crawl task
db.add_task("Official Account name")
# Get task list
tasks = db.get_crawl_tasks()
db.close()from cookie_utils import convert_to_db_format, detect_format, print_cookie_help
# Auto‑detect format and convert
cookies_dict = convert_to_db_format(browser_cookie_text)
# => {'uin': 'xxx', 'key': 'xxx', ...}
# Detect format type
fmt = detect_format(cookie_text) # 'json_devtools' | 'netscape' | 'json_domain' | 'header_str'
# Get operation guide
help_text = print_cookie_help()| Table | Description |
|---|---|
wechat_cookies | Cookie cache (auto‑managed) |
wechat_accounts | Official Account information |
wechat_articles | Article content |
wechat_article_stats | Article statistics |
wechat_comments | Comment data |
crawl_tasks | Crawl task list |
-- View all articles
SELECT a.title, a.link, s.read_num, s.like_num
FROM wechat_articles a
LEFT JOIN wechat_article_stats s ON a.id = s.article_id
ORDER BY a.create_time DESC;
-- Count articles per Official Account
SELECT ac.account_name, COUNT(a.id) as cnt
FROM wechat_articles a
JOIN wechat_accounts ac ON a.account_id = ac.id
GROUP BY ac.account_name;
-- Manage crawl tasks
INSERT INTO crawl_tasks (gzh_name, type, status) VALUES ('Account name', 1, 1);
UPDATE crawl_tasks SET status=0 WHERE gzh_name='Account name';⚠️ Cookie validity: WeChat cookies typically last from several hours to a few days. When expired, the user will be prompted to provide a fresh cookie.
⚠️ Token auto‑extraction: As of v2, manual token provision is no longer required – the crawler automatically extracts it from the WeChat Official Platform. If auto‑extraction fails, the user will be prompted to manually specify --token.
⚠️ Cookie format auto‑detection: The tool supports automatic format detection, but the --cookie-domain method (copying from the Application panel) is recommended as it is the most stable.
⚠️ Anti‑scraping measures:
⚠️ QR‑code login (fallback): The traditional QR login method is retained in the weChat_login() method and requires a working Chrome browser environment.
Feel free to adjust any terms to better match your forum's style (e.g., "Official Account" vs "Public Account"). Let me know if you need any modifications.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.