跳到主要内容
知仓学习社ZHICANG

baoyu-post-to-wechat

自媒体创作者与运营专员在需要将 Markdown 或 HTML 内容发布至微信公众号时,一键通过 API 或浏览器自动化完成文章与图文的排版及发布,彻底告别繁琐的手动排版与多步上传操作,大幅提升公众号日常发文与运营效率。

读凭据执行命令联网写文件读文件严重 15 · 高危 41anbeime/skill

它会碰到什么

扫了多少25 个文本文件,219 KB
它会碰到什么读凭据执行命令联网写文件读文件
命中总数100 处
命中统计严重 15 · 高 41 · 中 30 · 低 14
逐条看命中(30 条严重或高危)
  • 严重 scripts/wechat-api.ts:70cred-paths
    const cwdEnvPath = path.join(process.cwd(), ".baoyu-skills", ".env");
  • 严重 scripts/wechat-api.ts:71cred-paths
    const homeEnvPath = path.join(os.homedir(), ".baoyu-skills", ".env");
  • 严重 scripts/wechat-api.ts:82cred-paths
    "Set via environment variables or in .baoyu-skills/.env file."
  • 严重 scripts/wechat-api.ts:379cred-paths
    2. <cwd>/.baoyu-skills/.env
  • 严重 scripts/wechat-api.ts:380cred-paths
    3. ~/.baoyu-skills/.env
  • 严重 SKILL.md:225cred-paths
    test -f .baoyu-skills/.env && grep -q "WECHAT_APP_ID" .baoyu-skills/.env && echo "project"
  • 严重 SKILL.md:225cred-paths
    test -f .baoyu-skills/.env && grep -q "WECHAT_APP_ID" .baoyu-skills/.env && echo "project"
  • 严重 SKILL.md:228cred-paths
    test -f "$HOME/.baoyu-skills/.env" && grep -q "WECHAT_APP_ID" "$HOME/.baoyu-skills/.env" && echo "user"
  • 严重 SKILL.md:228cred-paths
    test -f "$HOME/.baoyu-skills/.env" && grep -q "WECHAT_APP_ID" "$HOME/.baoyu-skills/.env" && echo "user"
  • 严重 SKILL.md:242cred-paths
    A) Project-level: .baoyu-skills/.env (this project only)
  • 严重 SKILL.md:243cred-paths
    B) User-level: ~/.baoyu-skills/.env (all projects)
  • 严重 SKILL.md:246cred-paths
    After location choice, prompt for values and write to `.env`:
  • 严重 SKILL.md:356cred-paths
    - Guided setup in Step 5, or manually set in `.baoyu-skills/.env`
  • 严重 SKILL.md:368cred-paths
    2. `<cwd>/.baoyu-skills/.env`
  • 严重 SKILL.md:369cred-paths
    3. `~/.baoyu-skills/.env`
  • scripts/cdp.ts:1exec-spawn
    import { spawn } from 'node:child_process';
  • scripts/cdp.ts:34cred-envread
    const override = process.env.WECHAT_BROWSER_CHROME_PATH?.trim();
  • scripts/cdp.ts:64cred-envread
    const base = process.env.XDG_DATA_HOME || path.join(os.homedir(), '.local', 'share');
  • scripts/cdp.ts:188exec-spawn
    const { execSync } = await import('node:child_process');
  • scripts/cdp.ts:188exec-spawn
    const { execSync } = await import('node:child_process');
  • scripts/cdp.ts:192exec-spawn
    const output = execSync(cmd, { encoding: 'utf-8', timeout: 5_000 }).trim();
  • scripts/copy-to-clipboard.ts:1exec-spawn
    import { spawn } from 'node:child_process';
  • scripts/md-to-wechat.ts:9exec-spawn
    import { spawnSync } from 'node:child_process';
  • scripts/md-to-wechat.ts:9exec-spawn
    import { spawnSync } from 'node:child_process';
  • scripts/md-to-wechat.ts:188exec-spawn
    const result = spawnSync('npx', ['-y', 'bun', renderScript, tempMdPath, '--theme', theme], {
  • scripts/md/render.ts:32cred-envread
    process.env.MD_THEME_CONFIG_PATH
  • scripts/md/render.ts:35cred-envread
    process.env.MD_THEME_DIR
  • scripts/paste-from-clipboard.ts:1exec-spawn
    import { spawnSync } from 'node:child_process';
  • scripts/paste-from-clipboard.ts:1exec-spawn
    import { spawnSync } from 'node:child_process';
  • scripts/paste-from-clipboard.ts:54exec-spawn
    const result = spawnSync('osascript', ['-e', script], { stdio: 'pipe' });

这一栏是扫描器报的事实,不是结论。命中多不等于有毒(安全工具、规则库、示例脚本本来就会包含危险写法),命中少也不等于干净。它和你手上的凭据、文件、网络有什么关系,需要你自己看。

技能内容

Post to WeChat Official Account

Language

Match user's language: Respond in the same language the user uses. If user writes in Chinese, respond in Chinese. If user writes in English, respond in English.

Script Directory

Agent Execution: Determine this SKILL.md directory as SKILL_DIR, then use ${SKILL_DIR}/scripts/<name>.ts.

| Script | Purpose |

|--------|---------|

| scripts/wechat-browser.ts | Image-text posts (图文) |

| scripts/wechat-article.ts | Article posting via browser (文章) |

| scripts/wechat-api.ts | Article posting via API (文章) |

Preferences (EXTEND.md)

Use Bash to check EXTEND.md existence (priority order):

# Check project-level first
test -f .baoyu-skills/baoyu-post-to-wechat/EXTEND.md && echo "project"

# Then user-level (cross-platform: $HOME works on macOS/Linux/WSL)
test -f "$HOME/.baoyu-skills/baoyu-post-to-wechat/EXTEND.md" && echo "user"

┌────────────────────────────────────────────────────────┬───────────────────┐

│ Path │ Location │

├────────────────────────────────────────────────────────┼───────────────────┤

│ .baoyu-skills/baoyu-post-to-wechat/EXTEND.md │ Project directory │

├────────────────────────────────────────────────────────┼───────────────────┤

│ $HOME/.baoyu-skills/baoyu-post-to-wechat/EXTEND.md │ User home │

└────────────────────────────────────────────────────────┴───────────────────┘

┌───────────┬───────────────────────────────────────────────────────────────────────────┐

│ Result │ Action │

├───────────┼───────────────────────────────────────────────────────────────────────────┤

│ Found │ Read, parse, apply settings │

├───────────┼───────────────────────────────────────────────────────────────────────────┤

│ Not found │ Run first-time setup ([references/config/first-time-setup.md](references/config/first-time-setup.md)) → Save → Continue │

└───────────┴───────────────────────────────────────────────────────────────────────────┘

EXTEND.md Supports: Default theme | Default publishing method (api/browser) | Default author | Default open-comment switch | Default fans-only-comment switch | Chrome profile path

First-time setup: [references/config/first-time-setup.md](references/config/first-time-setup.md)

Minimum supported keys (case-insensitive, accept 1/0 or true/false):

| Key | Default | Mapping |

|-----|---------|---------|

| default_author | empty | Fallback for author when CLI/frontmatter not provided |

| need_open_comment | 1 | articles[].need_open_comment in draft/add request |

| only_fans_can_comment | 0 | articles[].only_fans_can_comment in draft/add request |

Recommended EXTEND.md example:

default_theme: default
default_publish_method: api
default_author: 宝玉
need_open_comment: 1
only_fans_can_comment: 0
chrome_profile_path: /path/to/chrome/profile

Value priority:

  1. CLI arguments
  2. Frontmatter
  3. EXTEND.md
  4. Skill defaults

Image-Text Posting (图文)

For short posts with multiple images (up to 9):

npx -y bun ${SKILL_DIR}/scripts/wechat-browser.ts --markdown article.md --images ./images/
npx -y bun ${SKILL_DIR}/scripts/wechat-browser.ts --title "标题" --content "内容" --image img.png --submit

See [references/image-text-posting.md](references/image-text-posting.md) for details.

Article Posting Workflow (文章)

Copy this checklist and check off items as you complete them:

Publishing Progress:
- [ ] Step 0: Load preferences (EXTEND.md)
- [ ] Step 1: Determine input type
- [ ] Step 2: Check markdown-to-html skill
- [ ] Step 3: Convert to HTML
- [ ] Step 4: Validate metadata (title, summary, cover)
- [ ] Step 5: Select method and configure credentials
- [ ] Step 6: Publish to WeChat
- [ ] Step 7: Report completion

Step 0: Load Preferences

Check and load EXTEND.md settings (see Preferences section above).

CRITICAL: If not found, complete first-time setup BEFORE any other steps or questions.

Resolve and store these defaults for later steps:

  • default_author
  • need_open_comment (default 1)
  • only_fans_can_comment (default 0)

Step 1: Determine Input Type

| Input Type | Detection | Action |

|------------|-----------|--------|

| HTML file | Path ends with .html, file exists | Skip to Step 4 |

| Markdown file | Path ends with .md, file exists | Continue to Step 2 |

| Plain text | Not a file path, or file doesn't exist | Save to markdown, then Step 2 |

Plain Text Handling:

  1. Generate slug from content (first 2-4 meaningful words, kebab-case)
  2. Create directory and save file:
mkdir -p "$(pwd)/post-to-wechat/$(date +%Y-%m-%d)"
# Save content to: post-to-wechat/yyyy-MM-dd/[slug].md
  1. Continue processing as markdown file

Slug Examples:

  • "Understanding AI Models" → understanding-ai-models
  • "人工智能的未来" → ai-future (translate to English for slug)

Step 2: Check Markdown-to-HTML Skill

Skip if: Input is .html file

Skill Discovery:

# Check if baoyu-markdown-to-html exists
test -f skills/baoyu-markdown-to-html/SKILL.md && echo "found"

| Result | Action |

|--------|--------|

| Found | Read its SKILL.md, continue to Step 3 |

| Multiple skills | AskUserQuestion to choose |

| Not found | Show installation suggestion |

When Not Found:

No markdown-to-html skill found.

Suggested installation:
https://github.com/JimLiu/baoyu-skills/blob/main/skills/baoyu-markdown-to-html/SKILL.md

Options:
A) Cancel - install the skill first
B) Continue - provide HTML file manually

Step 3: Convert Markdown to HTML

Skip if: Input is .html file

  1. Ask theme preference (unless specified in EXTEND.md or CLI):

| Theme | Description |

|-------|-------------|

| default | 经典主题 - 传统排版,标题居中带底边,二级标题白字彩底 |

| grace | 优雅主题 - 文字阴影,圆角卡片,精致引用块 |

| simple | 简洁主题 - 现代极简风,不对称圆角,清爽留白 |

  1. Execute conversion (using the discovered skill):
npx -y bun ${MD_TO_HTML_SKILL_DIR}/scripts/main.ts <markdown_file> --theme <theme>
  1. Parse JSON output to get: htmlPath, title, author, summary, contentImages

Step 4: Validate Metadata

Check extracted metadata from Step 3 (or HTML meta tags if direct HTML input).

| Field | If Missing |

|-------|------------|

| Title | Prompt: "Enter title, or press Enter to auto-generate from content" |

| Summary | Prompt: "Enter summary, or press Enter to auto-generate (recommended for SEO)" |

| Author | Use fallback chain: CLI --author → frontmatter author → EXTEND.md default_author |

Auto-Generation Logic:

  • Title: First H1/H2 heading, or first sentence
  • Summary: First paragraph, truncated to 120 characters

Cover Image Check (required for article_type=news):

  1. Use CLI --cover if provided.
  2. Else use frontmatter (featureImage, coverImage, cover, image).
  3. Else check article directory default path: imgs/cover.png.
  4. Else fallback to first inline content image.
  5. If still missing, stop and request a cover image before publishing.

Step 5: Select Publishing Method and Configure

Ask publishing method (unless specified in EXTEND.md or CLI):

| Method | Speed | Requirements |

|--------|-------|--------------|

| api (Recommended) | Fast | API credentials |

| browser | Slow | Chrome, login session |

If API Selected - Check Credentials:

# Check project-level
test -f .baoyu-skills/.env && grep -q "WECHAT_APP_ID" .baoyu-skills/.env && echo "project"

# Check user-level
test -f "$HOME/.baoyu-skills/.env" && grep -q "WECHAT_APP_ID" "$HOME/.baoyu-skills/.env" && echo "user"

If Credentials Missing - Guide Setup:

WeChat API credentials not found.

To obtain credentials:
1. Visit https://mp.weixin.qq.com
2. Go to: 开发 → 基本配置
3. Copy AppID and AppSecret

Where to save?
A) Project-level: .baoyu-skills/.env (this project only)
B) User-level: ~/.baoyu-skills/.env (all projects)

After location choice, prompt for values and write to .env:

WECHAT_APP_ID=<user_input>
WECHAT_APP_SECRET=<user_input>

Step 6: Publish to WeChat

API method:

npx -y bun ${SKILL_DIR}/scripts/wechat-api.ts <html_file> [--title <title>] [--summary <summary>] [--author <author>] [--cover <cover_path>]

draft/add payload rules:

  • Use endpoint: POST https://api.weixin.qq.com/cgi-bin/draft/add?access_token=ACCESS_TOKEN
  • article_type: news (default) or newspic
  • For news, include thumb_media_id (cover is required)
  • Always resolve and send:
  • need_open_comment (default 1)
  • only_fans_can_comment (default 0)
  • author resolution: CLI --author → frontmatter author → EXTEND.md default_author

If script parameters do not expose the two comment fields, still ensure final API request body includes resolved values.

Browser method:

npx -y bun ${SKILL_DIR}/scripts/wechat-article.ts --html <html_file>

Step 7: Completion Report

For API method, include draft management link:

WeChat Publishing Complete!

Input: [type] - [path]
Method: API
Theme: [theme name]

Article:
• Title: [title]
• Summary: [summary]
• Images: [N] inline images
• Comments: [open/closed], [fans-only/all users]

Result:
✓ Draft saved to WeChat Official Account
• media_id: [media_id]

Next Steps:
→ Manage drafts: https://mp.weixin.qq.com (登录后进入「内容管理」→「草稿箱」)

Files created:
[• post-to-wechat/yyyy-MM-dd/slug.md (if plain text)]
[• slug.html (converted)]

For Browser method:

WeChat Publishing Complete!

Input: [type] - [path]
Method: Browser
Theme: [theme name]

Article:
• Title: [title]
• Summary: [summary]
• Images: [N] inline images

Result:
✓ Draft saved to WeChat Official Account

Files created:
[• post-to-wechat/yyyy-MM-dd/slug.md (if plain text)]
[• slug.html (converted)]

Detailed References

| Topic | Reference |

|-------|-----------|

| Image-text parameters, auto-compression | [references/image-text-posting.md](references/image-text-posting.md) |

| Article themes, image handling | [references/article-posting.md](references/article-posting.md) |

Feature Comparison

| Feature | Image-Text | Article (API) | Article (Browser) |

|---------|------------|---------------|-------------------|

| Plain text input | ✗ | ✓ | ✓ |

| HTML input | ✗ | ✓ | ✓ |

| Markdown input | Title/content | ✓ (via skill) | ✓ (via skill) |

| Multiple images | ✓ (up to 9) | ✓ (inline) | ✓ (inline) |

| Themes | ✗ | ✓ | ✓ |

| Auto-generate metadata | ✗ | ✓ | ✓ |

| Default cover fallback (imgs/cover.png) | ✗ | ✓ | ✗ |

| Comment control (need_open_comment, only_fans_can_comment) | ✗ | ✓ | ✗ |

| Requires Chrome | ✓ | ✗ | ✓ |

| Requires API credentials | ✗ | ✓ | ✗ |

| Speed | Medium | Fast | Slow |

Prerequisites

For API method:

  • WeChat Official Account API credentials
  • Guided setup in Step 5, or manually set in .baoyu-skills/.env

For Browser method:

  • Google Chrome
  • First run: log in to WeChat Official Account (session preserved)

For Markdown conversion:

  • A markdown-to-html skill (e.g., baoyu-markdown-to-html)
  • If not installed, the workflow will suggest installation

Config File Locations (priority order):

  1. Environment variables
  2. <cwd>/.baoyu-skills/.env
  3. ~/.baoyu-skills/.env

Troubleshooting

| Issue | Solution |

|-------|----------|

| No markdown-to-html skill | Install baoyu-markdown-to-html from suggested URL |

| Missing API credentials | Follow guided setup in Step 5 |

| Access token error | Check if API credentials are valid and not expired |

| Not logged in (browser) | First run opens browser - scan QR to log in |

| Chrome not found | Set WECHAT_BROWSER_CHROME_PATH env var |

| Title/summary missing | Use auto-generation or provide manually |

| No cover image | Add frontmatter cover or place imgs/cover.png in article directory |

| Wrong comment defaults | Check EXTEND.md keys need_open_comment and only_fans_can_comment |

| Paste fails | Check system clipboard permissions |

Extension Support

Custom configurations via EXTEND.md. See Preferences section for paths and supported options.

想直接用这个技能?

本站把开放许可(MIT / Apache 等)的技能按仓库打包整理到网盘,点一下转存到你自己的网盘,不用一个个从 GitHub 拉。许可未声明的技能只给原始仓库链接,不打包。

它属于哪个仓库

星标★ 6,808
本站分层T1
该仓技能数84
原文件路径skills/content-creation-publisher/baoyu-post-to-wechat/SKILL.md

同一个仓库里的其他技能

看这个仓库的全部 84 个技能