xfg-zsxq-skills

知识星球自动化技能。支持发帖、回帖、浏览帖子、检查通知、自动回帖、自动发帖。自动读取 ~/.xfg-zsxq/groups.json 配置。支持定时任务自动检查通知和被圈提醒。回复功能使用浏览器自动化（Playwright MCP）。触发词：'知识星球'、'发帖'、'回帖'、'zsxq'、'检查通知'、'浏览帖子...

Security Scan

The skill's code, instructions, and requested access are consistent with its stated purpose (automating 知识星球 posts/notifications); it primarily needs the user's knowledge-site cookie and local config files and does not request unrelated credentials or system-wide privileges.

Purpose & Capability

The name/description describe automation for 知识星球 (post, reply, check notifications, cron). The repository includes scripts that implement those features and read/write ~/.xfg-zsxq/groups.json. Required capabilities (HTTP requests to api.zsxq.com, cookie-based auth, optional image upload to qiniu) match the stated purpose. There is a minor doc mismatch: SKILL.md mentions Playwright MCP for browser automation while package.json lists puppeteer as a dependency; this is a documentation/implementation inconsistency but does not indicate malicious behavior.

Instruction Scope

SKILL.md and scripts instruct the agent/user to obtain and store the full site Cookie and to run local Node scripts. The runtime instructions explicitly reference only the knowledge-planet APIs, the local config path (~/.xfg-zsxq/groups.json), and the OpenClaw browser tooling for interactive automation. There are no instructions to read unrelated system files or to exfiltrate data to unexpected endpoints beyond api.zsxq.com and qiniu (used for image upload).

Install Mechanism

This is instruction- and script-based with no platform install spec. A package.json declares 'puppeteer' (heavy dependency) but there is no automated install step described; users will need to npm install if they want browser automation. Because no install script runs automatically, there's lower installer risk, but users should be aware that dependencies (puppeteer) are required for automated browser actions.

Credentials

The skill requires the user's 知识星球 cookie (zsxq_access_token) stored in ~/.xfg-zsxq/groups.json and uses it to call api.zsxq.com. Requesting the cookie is proportionate to performing authenticated post/reply operations. The code stores configuration with file mode 0o600 (README claims permission 600), which is appropriate for sensitive tokens. No unrelated environment variables or unrelated service credentials are requested.

Persistence & Privilege

always:false and no special OS-wide privileges are requested. Scripts read/write files under the user's home (~/.xfg-zsxq and cron-config.json) which is expected for a per-user automation tool. The cron-setup script writes a cron-config JSON and prints OpenClaw CLI commands but does not autonomously register system cron jobs or modify other skills' configurations.

Assessment

This skill is coherent with its stated purpose but it handles sensitive data: it asks you to paste your full 知识星球 Cookie (contains zsxq_access_token). Before installing or running: 1) Review the scripts yourself and only store cookies you trust this tool with; the tool saves them under ~/.xfg-zsxq/groups.json (recommend file mode 600 and only use on accounts you control). 2) Be aware browser automation requires installing puppeteer (package.json) or using the platform's browser actions; follow README instructions and install dependencies in an isolated environment if possible. 3) Image uploads go to qiniu (upload-z1.qiniup.com) which is expected for the service but note third-party storage. 4) If you expect the agent to run autonomously, understand scheduled task instructions only produce config and CLI commands — the script doesn't silently create system cron jobs. 5) Minor docs mismatch: SKILL.md mentions Playwright while package.json lists puppeteer; confirm which automation tool you'll run. If any of this is unexpected, do not provide your cookie or run the scripts until you are comfortable.

知识星球自动化技能

支持发帖、回帖、浏览帖子、检查通知、自动回帖等完整功能。

⚡ 快速开始

1. 配置 Cookie

执行技能目录下的脚本：

# 添加星球配置
node {skills}/scripts/zsxq.js config add \
  --url "https://wx.zsxq.com/group/星球ID" \
  --cookie "你的完整Cookie"

获取 Cookie 方法：

1. 登录 https://wx.zsxq.com
2. 按 F12 → Network 标签
3. 点击任意请求（如 api.zsxq.com）
4. 复制 Request Headers 中的完整 Cookie 头值

2. 查看本地已保存配置信息

# 执行命令返回本地保存的知识星球ID等信息
node zsxq.js config list

或者读取用户主目录的下的文件获取已保存的信息

~/.xfg-zsxq/groups.json

---

📝 发帖

# 简单文字发帖
node zsxq.js post --text "今天分享一个技术心得..."

# 带图片发帖（最多9张）
node zsxq.js post --text "内容" --images "/path/a.jpg,/path/b.png"

# 从文件读取内容
node zsxq.js post --file "/tmp/post.txt"

---

📖 浏览帖子

# 查看最新帖子（脚本）
node zsxq-auto-check.js

# 或直接用 curl/API
curl "https://api.zsxq.com/v2/groups/{group_id}/topics?count=10" \
  -H "cookie: $COOKIE"

---

💬 回复帖子（浏览器自动化）

回复功能使用浏览器自动化：

1. 打开星球页面

   exec command="open 'https://wx.zsxq.com/group/星球ID'"
   

2. 获取页面快照

   browser action=snapshot target=host refs=aria
   

3. 点击评论按钮（找到对应帖子的评论按钮 ref）

   browser action=act target=host ref=<评论按钮ID> kind=click
   

4. 输入回复内容

   browser action=act target=host ref=<输入框ID> kind=type text="回复内容"
   

5. 发送评论

   browser action=act target=host ref=<发送按钮ID> kind=click
   

---

📝 发布文章

# 发布到草稿箱（默认）
node zsxq-auto-post-article.js --cookie "xxx" --title "文章标题" --content "<p>文章内容</p>"

# 更新已有草稿（指定article_id）
node zsxq-auto-post-article.js --cookie "xxx" --title "标题" --content "<p>内容</p>" --article "文章ID"

# 若需直接诶发布为文章，建议先保存为草稿后再发布
node zsxq-auto-post-article.js --cookie "xxx" --title "文章标题" --content "<p>文章内容</p>" --publish true --article "文章ID"

🔔 检查通知

node zsxq-auto-check.js

参数：

• --scope all - 所有动态（默认）
• --scope related - 与我相关（被圈、评论等）
• --count 30 - 获取数量

---

🕐 设置定时任务

当需要自动检查通知时，创建 cron 任务：

# 使用 cron 工具创建每30分钟检查一次的任务
# 在 OpenClaw 中说"设置定时任务"即可自动创建

📁 References 路由表

当需要详细参考信息时，按需加载以下文件：

文件	用途	何时读取
references/api.md	API 接口文档	发帖/浏览/上传图片时
references/usage.md	详细使用指南	需要批量发帖/Git集成时
references/faq.md	常见问题解答	遇到错误时
references/signature.md	签名生成方法	需要手动生成签名时
references/token-config.md	Token 配置说明	配置 Cookie/Token 时
references/puppeteer.md	浏览器自动化	使用自动回复功能时

---

📁 API 接口状态

功能	接口	方法	状态
发帖	/v2/groups/{group_id}/topics	POST	⚠️ 需有效 Cookie
发布草稿文章	/v2/articles/drafts	POST	⚠️ 需有效 Cookie
浏览帖子	/v2/groups/{group_id}/topics	GET	✅ 正常
回复帖子	/v2/topics/{topic_id}/comments	POST	⚠️ 需浏览器自动化
获取动态	/v2/dynamics?scope=all	GET	✅ 正常

---

🔧 常见问题

❌ 发帖失败 (code: 1004/1059)

原因： Cookie 已过期或无效

解决方法：

1. 登录 https://wx.zsxq.com
2. 按 F12 → Network
3. 复制新的 Cookie
4. 更新配置：

node zsxq.js config add --url "https://wx.zsxq.com/group/ID" --cookie "新Cookie"

❌ 回复帖子失败

原因： API 回复有频率限制

解决方法： 使用浏览器自动化方式回复（见上方教程）

---

🔐 Cookie 格式

确保 Cookie 包含以下关键字段：

zsxq_access_token=xxx; sensorsdata2015jssdkcross=xxx; sajssdk_2015_cross_new_user=1; abtest_env=product

---

📁 项目结构

xfg-zsxq-skills/
├── SKILL.md                 # 技能文档
├── README.md                # 说明文档
├── scripts/                 # 可执行脚本
│   ├── zsxq.js              # 主脚本（配置/发帖/浏览）
│   ├── zsxq-auto-check.js   # 自动检查通知
│   ├── zsxq-auto-reply.js   # 自动回复（浏览器自动化）
│   ├── zsxq-auto-post.js    # 发帖脚本
│   ├── zsxq-auto-post-article.js  # 发布文章
│   └── zsxq-cron-setup.js   # 定时任务设置
└── references/              # 参考文档（按需加载）
    ├── api.md               # API 接口文档
    ├── usage.md             # 详细使用指南
    ├── faq.md               # 常见问题
    ├── signature.md         # 签名生成
    ├── token-config.md      # Token 配置
    └── puppeteer.md         # 浏览器自动化

注意：references 目录下的文件不会自动加载到上下文，仅在需要时由 AI 自行读取。

---

参考

• 知识星球网页版：https://wx.zsxq.com
• 配置文件：~/.xfg-zsxq/groups.json
• 脚本目录：xfg-zsxq-skills/scripts