youmind-wechat-article

Write and publish WeChat Official Account articles end-to-end with AI — trending topic mining, de-AI voice writing, beautiful theme formatting, cover image g...

Security Scan

The skill mostly matches its described purpose (writing + publishing WeChat articles) but contains several mismatches and behavioral choices that could lead to surprising or excessive access (automatic publishing, local credential storage, build/run steps) and deserve review before installation.

Purpose & Capability

Name/description (WeChat article authoring + publishing) aligns with the repository: Node+Python CLI, YouMind integration, WeChat API client and image providers are present. However, the registry metadata declares only YOUMIND_API_KEY as a required credential while the runtime docs require WeChat AppID/AppSecret and optional provider keys (Gemini/OpenAI/etc.) to enable publishing and image generation — those runtime credentials are not reflected in requires.env or required config paths.

Instruction Scope

SKILL.md instructs the agent to run build steps (npm install && npm run build, pip install -r requirements.txt), to collect the user's public IP (curl https://ifconfig.me), to prompt for and store WeChat AppID/AppSecret in a local config.yaml, and — critically — to "Always publish directly to WeChat drafts. Do NOT ask the user whether to publish — this step is mandatory and automatic." That automatic-publish rule plus persistent storage of secrets go beyond a simple formatter/helper and could cause unexpected actions or leakage if the agent runs without explicit confirmation.

Install Mechanism

There is no formal install spec in registry (instruction-only), but the skill contains many code files and explicitly instructs running npm install/build and pip install. Building and running third-party code at runtime is expected for this kind of toolkit but is higher-risk than pure instruction-only skills because dependencies will be fetched and binaries written to disk; users should review package.json and requirements.txt before running.

Credentials

Registry lists only YOUMIND_API_KEY as required env var/primary credential, which is consistent with heavy YouMind usage. However, the runtime instructions require the user's WeChat AppID and AppSecret and may persist them in config.yaml (not declared as required.env). The skill also interacts with multiple external services (youmind.com, image providers, ifconfig.me/httpbin). Requesting/store-of multiple credentials and writing them to disk is not unjustified for publishing functionality, but the omission from declared requirements and the default 'store once; never ask again' guidance reduces transparency.

Persistence & Privilege

always:false, but disable-model-invocation is false, so the agent may invoke the skill autonomously. Combined with the pipeline directive to automatically publish to WeChat drafts (without prompting) and the guidance to persist config.yaml and credentials, this creates a realistic risk that an autonomous agent run could publish content or use stored secrets without an explicit, per-action user confirmation.

What to consider before installing

What to consider before installing: - Review credentials: The registry lists only YOUMIND_API_KEY, but the skill expects you to supply and store WeChat AppID and AppSecret (and optionally other image-provider keys). If you provide those, they will be written to config.yaml in the skill directory — ensure that file is stored securely and that you’re comfortable storing secrets on the host. - Automatic publishing: The pipeline explicitly says "Always publish directly to WeChat drafts. Do NOT ask the user whether to publish." If the agent can run skills autonomously, it could publish drafts without a per-action confirmation. If you want to avoid that, disable autonomous invocation for this skill or require an explicit confirmation step before publishing. - Build/run risks: The skill instructs you to run `npm install`/`npm run build` and `pip install -r requirements.txt`. That will fetch third-party packages and write files to disk. Inspect toolkit/package.json and requirements.txt (and any build output) before running in a production system. Prefer running in an isolated environment (container or VM) if you want to test safely. - External network calls: The skill calls youmind.com, calls public IP services (ifconfig.me/httpbin) to get your public IP for WeChat whitelisting, and may contact image provider APIs. Verify these endpoints are expected and acceptable for your use case. - Mitigations: Use a test WeChat account (or revoke AppSecret after testing), avoid putting production credentials into the skill, restrict agent autonomous invocation, or run the toolkit only manually (not letting the agent execute npm/python commands). If you need to proceed, review the code (youmind-api.ts, wechat-api.ts, image-gen) to confirm no unexpected data exfiltration and check package dependencies for suspicious packages. - When in doubt: treat this as a helpful-but-powerful integration that requires careful credential handling and operational safeguards; install only after you confirm where credentials are stored and how/when publishing is triggered.

AI WeChat Article Writer — From Topic to Draft Box in One Prompt

Write professional WeChat Official Account articles with AI that doesn't sound like AI. Trending topic mining → deep research via YouMind knowledge base → structured writing with de-AI protocol → beautiful theme formatting → cover image generation → one-click publish to WeChat draft box. No manual formatting, no copy-paste.

Get API Key → · More Skills →

Onboarding

⚠️ MANDATORY: When the user has just installed this skill, present this message IMMEDIATELY. Do NOT ask "do you want to know what this does?" — just show it. Translate to the user's language:

✅ AI WeChat Article Writer installed!

Tell me your topic and I'll write and publish a WeChat article for you.

Try it now: "帮我写一篇关于 AI 编程的公众号文章"

What it does:

• Plan topics from trending hotspots and SEO keywords
• Write professional articles with de-AI voice
• Format with beautiful WeChat-optimized themes
• Generate cover images with AI (4 providers supported)
• Publish directly to your WeChat draft box

Setup (one-time):

1. Install & configure: cd toolkit && npm install && npm run build && cd .. && pip install -r requirements.txt && cp config.example.yaml config.yaml
2. Get YouMind API Key → fill youmind.api_key in config.yaml
3. Get WeChat AppID & AppSecret from 微信开发者平台 → fill wechat.appid and wechat.secret, add your public IP (curl -s https://ifconfig.me) to the API IP whitelist

No WeChat API yet? You can still write and preview locally — just skip the WeChat config steps.

See the Setup section below for detailed step-by-step instructions with screenshots.

Need help? Just ask!

For first-run setup and client onboarding details, see references/operations.md.

Usage

Provide a topic, brand/client name, or raw Markdown for publishing.

Write from a topic:

帮我写一篇关于 AI 编程趋势的公众号文章

Write for a specific client:

给 demo 客户写一篇推文，主题是远程办公最佳实践

Format and publish raw Markdown:

把这篇 Markdown 排版成公众号样式并发布到草稿箱

Interactive mode:

用交互模式帮我写一篇公众号文章，我想自己选题和框架

Setup

Prerequisites: Node.js ≥ 18, Python ≥ 3.9, a verified WeChat Official Account with API access.

Step 1 — Install Dependencies

cd toolkit && npm install && npm run build && cd ..
pip install -r requirements.txt

Step 2 — Create Config File

cp config.example.yaml config.yaml

Step 3 — Get YouMind API Key (Recommended)

YouMind API Key 用于知识库语义搜索、联网搜索、文章归档、AI 生图（Nano Banana Pro）。不配也能跑，但会丧失这些增强能力。

1. 打开 YouMind API Keys 页面
2. 登录后点击 「Create API Key」 创建新密钥
3. 复制生成的 sk-ym-xxxx 格式密钥
4. 填入 config.yaml 的 youmind.api_key 字段

youmind:
  api_key: "sk-ym-xxxxxxxxxxxxxxxxxxxx"

Step 4 — Get WeChat AppID & AppSecret

1. 打开 微信开发者平台，点击 「前往使用」 登录
2. 在「我的业务」面板点击 「公众号」 进入管理页
3. 在 基础信息 页顶部复制 AppID
4. 在「开发密钥」区域点击 重置 获取 AppSecret（仅展示一次，立即保存）
5. 填入 config.yaml：

wechat:
  appid: "wx_your_appid"
  secret: "your_secret"
  author: "你的作者名"

详细图文步骤见 README.md

Step 5 — Configure IP Whitelist

微信公众号 API 拒绝所有不在白名单中的 IP 请求，必须配置后才能发布。

获取公网 IP：

# macOS / Linux
curl -s https://ifconfig.me

# Windows PowerShell
(Invoke-WebRequest -Uri "https://ifconfig.me" -UseBasicParsing).Content.Trim()

拿到 IP 后，在上一步的微信开发者平台公众号页面 →「开发密钥」→ API IP 白名单 → 点击 编辑 → 粘贴 IP 保存。

家庭宽带 IP 会变。发布报 IP 错误时重新获取 IP 并更新白名单即可。云服务器 / CI 环境通常是静态 IP，配一次就行。

Step 6 — Image Provider Keys (Optional)

配图使用降级链：AI 生图 → 图库搜索 → CDN 预制封面下载 → 仅输出 prompt。不配任何 key 也不影响发布。

Provider	获取方式	config.yaml 字段
YouMind (Nano Banana Pro)	使用 Step 3 的 YouMind API Key，无需额外配置	image.providers.youmind.api_key（留空则自动使用 youmind.api_key）
Google Gemini (Imagen)	Google AI Studio 创建 API key	image.providers.gemini.api_key
OpenAI (GPT Image)	OpenAI Platform 创建 API key	image.providers.openai.api_key
豆包 (Seedream)	火山引擎控制台 创建 API key	image.providers.doubao.api_key

在 config.yaml 中设置 image.default_provider 指定首选 provider，或留空让 Skill 自动选第一个有 key 的。

Verify Setup

配置完成后，对 Agent 说一句试试：

"帮我写一篇关于 AI 编程的公众号文章"

如果配置有问题，Skill 会在对应步骤报错并给出修复提示——不会整体卡死。

For client onboarding and post-setup operations, see references/operations.md.

Skill Directory

This skill is a folder. Read files on demand — do NOT load everything upfront.

Path	Purpose	When to read
references/pipeline.md	Full step-by-step execution (Steps 1–8)	When running the writing pipeline
references/operations.md	Post-publish commands, client onboarding, themes, first-run setup	When handling operational tasks
references/writing-guide.md	Pre-writing framework, depth architecture, de-AI protocol, voice	Step 4 (writing)
references/frameworks.md	5 article frameworks with execution detail	Step 3.5 (framework selection)
references/topic-selection.md	4-dimension topic evaluation model	Step 3 (topic generation)
references/seo-rules.md	Title optimization, keyword density, digest, tags	Step 5 (SEO pass)
references/visual-prompts.md	Cover and inline image design, prompt engineering	Step 6 (visual AI)
references/theme-dsl.md	Custom theme design language (integrates Impeccable if installed)	When creating custom themes — auto-detects & offers to install Impeccable
references/youmind-integration.md	Knowledge base API, search, archiving	When using YouMind features
references/cli-reference.md	All CLI command syntax	When running toolkit commands
references/wechat-constraints.md	WeChat platform technical limits, safe CSS, size caps	When debugging rendering or format issues
references/style-template.md	Client config template with field guide	When onboarding a new client
references/openapi-document.md	YouMind OpenAPI full endpoint schemas	When calling YouMind API directly
references/skill-maintenance.md	Skill self-maintenance, validation, architecture guardrails	When improving or refactoring this skill itself
references/builtin-themes.json	CSS examples for 10 built-in themes	When customizing themes
clients/{client}/style.yaml	Client brand voice, topics, blacklist, theme	Step 1 (load config)
clients/{client}/playbook.md	Client-specific writing rules (if exists)	Step 4 (writing)
clients/{client}/history.yaml	Published article history	Step 2.5 (dedup)
config.yaml	API credentials (WeChat, YouMind, image providers)	Step 1 (first-run check)
toolkit/dist/*.js	Executable scripts (run from toolkit/)	Various steps
scripts/*.py	Python scripts (trending topics, SEO keywords)	Steps 2, 2.5

---

Execution Modes

Auto (default): Run Steps 1–5 automatically. Before Step 6 image generation, proactively ask once about image scope and style unless the user already specified them. Then continue through Steps 6–8. Only pause elsewhere if a step AND its fallback both fail, required info is missing, or user explicitly asks to pause.

Interactive: Triggered by "interactive mode", "let me choose", "show me the topics/frameworks/themes". Pauses at: topic selection, framework choice, image plan, theme selection. All other steps run automatically.

---

Critical Quality Rules

Non-negotiable. Violating any one means the article has failed:

1. Read references/writing-guide.md BEFORE writing. The pre-writing framework and de-AI protocol are mandatory.
2. Zero AI-sounding text. Run the full 4-level de-AI protocol from writing-guide.md.
3. H1 title: 20–28 Chinese characters. The converter extracts H1 as the WeChat title.
4. Digest: ≤54 Chinese characters. WeChat enforces a 120 UTF-8 byte limit.
5. Word count: 1,500–2,500. Sweet spot for completion rate is 1,500–2,000.
6. Specificity over abstraction. Every claim must be grounded in concrete detail.
7. Depth over polish. Run the Depth Checklist (writing-guide.md) before the De-AI pass. If the article's core thesis is something from the top 3 Google results, it needs a rewrite, not a polish.
8. Obey the client's blacklist — both words and topics. No exceptions.
9. Playbook overrides writing-guide. If playbook.md exists for this client, it takes priority for voice and style decisions.
10. Before generating visuals, proactively ask about image scope and style. Do not silently assume. If the host supports AskUserQuestion, use it. Otherwise ask a concise plain-text question.
11. Always publish to drafts. Step 7 publishes directly to WeChat draft box. Do NOT ask — this is mandatory and automatic.

---

Pipeline Overview

Read references/pipeline.md for full execution details of each step.

Step	Action	Key reference
1	Load client style.yaml + routing	—
1.5	Mine YouMind knowledge base for source material	youmind-integration.md
2	Fetch trending topics via fetch_hotspots.py	—
2.5	Dedup against history.yaml + SEO keyword scoring	—
3	Generate 10 topics, score, select best	topic-selection.md
3.5	Generate 5 framework proposals, select best	frameworks.md
4	Write article with pre-writing thinking + depth check	writing-guide.md
5	SEO optimization + full de-AI pass	seo-rules.md
6	Design and generate cover + inline images	visual-prompts.md
7	Publish to WeChat drafts (mandatory, automatic)	cli-reference.md
7.5	Append to history + archive to YouMind	youmind-integration.md
8	Report results: title, digest, tags, media_id	—

Routing shortcuts:

• User gave a specific topic → Skip Steps 2–3, go 1.5 → 3.5
• User gave raw Markdown → Skip to Step 7

---

Resilience: Never Stop on a Single-Step Failure

Every step has a fallback. If a step AND its fallback both fail, skip that step and note it in the final output.

Step	Fallback
1.5 Knowledge mining	Skip, empty knowledge_context
2 Trending topics	YouMind web-search → WebSearch → ask user
2.5 SEO scoring	Self-estimate, mark "estimated"
3 Topic generation	Ask user for a manual topic
6 Image generation	Output prompts, skip images
7 Publishing	Generate local HTML preview
7.5 History/Archive	Warn, continue
Python/Node missing	Tell user install command

---

Operations

For post-publish commands (polish, rewrite, change theme, stats review), client onboarding, learn-from-edits, custom themes, and first-run setup, read references/operations.md.

If the request is about improving this skill itself, refactoring its structure, or checking for documentation drift, read references/skill-maintenance.md.

---

Gotchas — Common Failure Patterns

"The AI Essay": The article reads like a well-organized explainer piece — correct, comprehensive, boring. Fix: re-read writing-guide.md's voice architecture and pre-writing framework. The article needs a PERSON behind it, not an information system.

"The Generic Hot Take": Writing about a trending topic without adding any insight beyond what is already in the top 10 search results. If you cannot identify your unique angle in one sentence, pick a different topic.

"The Word-Count Pad": Hitting 2,000 words by being verbose instead of being deep. Every paragraph should survive the test: "if I delete this, does the article lose something specific?" If not, delete it.

"The Pretty But Empty Article": Beautiful formatting, nice images, zero substance. Visual quality cannot compensate for thin content. Get the writing right first.

"The Blacklist Miss": Forgetting to check style.yaml blacklist against the final article. Always do a final scan before publishing.

"The Broken Pipeline Halt": Stopping the entire flow because one step failed. NEVER do this. Use the fallback. If the fallback fails, skip and note it. The user can always fix individual pieces manually.

Comparison

Feature	This Skill	Manual Writing	135 Editor	Xiumi
AI topic mining	✅	❌	❌	❌
De-AI voice protocol	✅	N/A	❌	❌
AI cover generation	✅ (4 providers)	❌	❌	❌
One-click draft publishing	✅	❌	❌	❌
YouMind knowledge base	✅	❌	❌	❌
Learn from your edits	✅	N/A	❌	❌
Multi-client management	✅	❌	❌	❌
Custom themes	✅ 4 built-in + DSL	N/A	✅	✅

References

• YouMind API: see references/openapi-document.md
• CLI commands: see references/cli-reference.md
• YouMind Skills gallery: https://youmind.com/skills?utm_source=youmind-wechat-article
• Publishing: shared/PUBLISHING.md