md2wechat

Convert Markdown to WeChat Official Account HTML, inspect supported providers/themes/prompts, generate article images, create drafts, write with creator styl...

Security Scan

The skill appears to be what it claims: a thin integration that drives the md2wechat CLI and legitimately asks for WeChat credentials to upload drafts; there are minor documentation/metadata mismatches but nothing that indicates intentional misdirection.

Purpose & Capability

The skill's name/description match the runtime requirements: it requires the md2wechat binary and WECHAT_APPID/WECHAT_SECRET for draft/publish operations. The documented capabilities (convert, preview, generate images, create drafts, humanize/remove AI traces) align with the CLI commands the SKILL.md instructs the agent to run.

Instruction Scope

The SKILL.md instructs the agent to run many md2wechat CLI commands and to consult local config files (e.g., ~/.config/md2wechat/config.yaml and project-local md2wechat.{yaml,yml,json}). Those file paths are reasonable for a CLI wrapper, but they are not declared in the skill's required config paths metadata. The docs also mention MD2WECHAT_BASE_URL (and editing api.md2wechat_base_url) which is an environment/config variable referenced by the instructions but not listed in requires.env. This is an inconsistency to be aware of but not inherently malicious.

Install Mechanism

Install options are a brew formula (geekjourneyx/tap/md2wechat) or a Go module from GitHub. Both are expected ways to install a CLI; the brew tap is a third‑party tap (not an official Homebrew core formula) so users should verify the tap/source before installing, but the mechanism itself is proportional to the task.

Credentials

The skill requires WECHAT_APPID and WECHAT_SECRET, which are appropriate and expected for uploading/publishing to a WeChat Official Account. The SKILL.md also references additional config envs (e.g., MD2WECHAT_BASE_URL) and local config files for image services; these extras are plausible but were not listed in the declared requires.env/config paths—minor mismatch but explainable.

Persistence & Privilege

The skill does not request always:true or other elevated persistence. It is instruction-only (drives an on‑disk binary) and does not declare modifications to other skills or global agent settings. Normal autonomous invocation is allowed (platform default).

Assessment

This skill is a thin wrapper around the md2wechat CLI and reasonably asks for your WeChat app credentials to create/upload drafts. Before installing or using it: (1) Verify the md2wechat binary's provenance (inspect the GitHub repo and brew tap), (2) only provide WECHAT_APPID and WECHAT_SECRET if you trust the binary and want it to be able to create drafts/publish, (3) be aware the skill may read/edit md2wechat config files in your home or project and may use MD2WECHAT_BASE_URL if present, so review/backup those configs, and (4) if you plan to install via the third‑party brew tap, review the tap contents or prefer installing from source (Go module) if you trust the upstream code. These are hygiene steps rather than indications of malicious behavior.

Use md2wechat when the user wants to:

• convert Markdown into WeChat Official Account HTML
• inspect resolved article metadata, readiness, and publish risks before conversion
• generate a local preview artifact or upload drafts
• inspect live capabilities, providers, themes, and prompts
• generate covers, infographics, or other article images
• create image posts
• write in creator styles or remove AI writing traces

Defaults And Config

• Use this skill only when md2wechat is already available on PATH.
• Draft upload and publish-related actions require WECHAT_APPID and WECHAT_SECRET.
• Image generation may require additional image-service configuration in ~/.config/md2wechat/config.yaml.
• convert defaults to api mode unless the user explicitly asks for --mode ai.
• Check configuration in this order:
  1. ~/.config/md2wechat/config.yaml
  2. environment variables such as MD2WECHAT_BASE_URL
  3. project-local md2wechat.yaml, md2wechat.yml, or md2wechat.json
• If the user asks to switch API domain, update api.md2wechat_base_url or MD2WECHAT_BASE_URL.
• Treat live CLI discovery output as the source of truth. Do not guess provider names, theme names, or prompt names from repository files alone.

Discovery First

Run these before selecting a provider, theme, or prompt:

• md2wechat version --json
• md2wechat capabilities --json
• md2wechat providers list --json
• md2wechat themes list --json
• md2wechat prompts list --json
• md2wechat prompts list --kind image --json
• md2wechat prompts list --kind image --archetype cover --json

Inspect a specific resource before using it:

• md2wechat providers show openrouter --json
• md2wechat themes show autumn-warm --json
• md2wechat prompts show cover-default --kind image --json
• md2wechat prompts show cover-hero --kind image --archetype cover --tag hero --json
• md2wechat prompts show infographic-victorian-engraving-banner --kind image --archetype infographic --tag victorian --json
• md2wechat prompts render cover-default --kind image --var article_title='Example' --json

When choosing image presets, prefer the prompt metadata returned by prompts show --json, especially primary_use_case, compatible_use_cases, recommended_aspect_ratios, and default_aspect_ratio.

Core Commands

Configuration:

• md2wechat config init
• md2wechat config show --format json
• md2wechat config validate

Conversion:

• md2wechat inspect article.md
• md2wechat preview article.md
• md2wechat convert article.md --preview
• md2wechat convert article.md -o output.html
• md2wechat convert article.md --draft --cover cover.jpg
• md2wechat convert article.md --mode ai --theme autumn-warm --preview
• md2wechat convert article.md --title "新标题" --author "作者名" --digest "摘要"

Image handling:

• md2wechat upload_image photo.jpg
• md2wechat download_and_upload https://example.com/image.jpg
• md2wechat generate_image "A cute cat sitting on a windowsill"
• md2wechat generate_image --preset cover-hero --article article.md --size 2560x1440
• md2wechat generate_cover --article article.md
• md2wechat generate_infographic --article article.md --preset infographic-comparison
• md2wechat generate_infographic --article article.md --preset infographic-dark-ticket-cn --aspect 21:9
• md2wechat generate_infographic --article article.md --preset infographic-handdrawn-sketchnote

Drafts and image posts:

• md2wechat create_draft draft.json
• md2wechat test-draft article.html cover.jpg
• md2wechat create_image_post -t "Weekend Trip" --images photo1.jpg,photo2.jpg
• md2wechat create_image_post -t "Travel Diary" -m article.md
• echo "Daily check-in" | md2wechat create_image_post -t "Daily" --images pic.jpg
• md2wechat create_image_post -t "Test" --images a.jpg,b.jpg --dry-run

Writing and humanizing:

• md2wechat write --list
• md2wechat write --style dan-koe
• md2wechat write --style dan-koe --input-type fragment article.md
• md2wechat write --style dan-koe --cover-only
• md2wechat write --style dan-koe --cover
• md2wechat write --style dan-koe --humanize --humanize-intensity aggressive
• md2wechat humanize article.md
• md2wechat humanize article.md --intensity aggressive
• md2wechat humanize article.md --show-changes
• md2wechat humanize article.md -o output.md

Article Metadata Rules

For convert, metadata resolution is:

• Title: --title -> frontmatter.title -> first Markdown heading -> 未命名文章
• Author: --author -> frontmatter.author
• Digest: --digest -> frontmatter.digest -> frontmatter.summary -> frontmatter.description

Limits enforced by the CLI:

• --title: max 32 characters
• --author: max 16 characters
• --digest: max 128 characters

Draft behavior:

• If digest is still empty when creating a draft, the draft layer generates one from article HTML content with a 120-character fallback.
• Creating a draft requires --cover.
• inspect is the source-of-truth command for resolved metadata, readiness, and checks.
• preview v1 writes a standalone local HTML preview file. It does not start a workbench, write back to Markdown, upload images, or create drafts.
• convert --preview is still the convert-path preview flag; it is not the same thing as the standalone preview command.
• preview --mode ai is degraded confirmation only; it must not be treated as final AI-generated layout.
• --title / --author / --digest affect draft metadata, not necessarily visible body HTML.
• Markdown images are only uploaded/replaced during --upload or --draft, not during plain convert --preview.

Agent Rules

• Start with discovery commands before committing to a provider, theme, or prompt.
• Prefer the confirm-first flow for article work: inspect -> preview -> convert / --draft.
• Prefer generate_cover or generate_infographic over a raw generate_image "prompt" call when a bundled preset fits the task.
• Validate config before any draft, publish, or image-post action.
• If draft creation returns 45004, check digest/summary/description before assuming the body content is too long.
• If the user asks for AI conversion or style writing, be explicit that the CLI may return an AI request/prompt rather than final HTML or prose unless the workflow completes the external model step.
• Do not perform draft creation, publishing, or remote image generation unless the user asked for it.

Safety And Transparency

• Reads local Markdown files and local images.
• May download remote images when asked.
• May call external image-generation services when configured.
• May upload HTML, images, drafts, and image posts to WeChat when the user explicitly requests those actions.