微信公众号文章生产SOP

微信公众平台文章全流程生产工具，涵盖选题、调研、撰写、去AI味、生成配图、HTML排版及提交草稿七个标准步骤。

Security Scan

The skill's functionality (WeChat article production + automatic submission) matches the included scripts, but the package/registry metadata omits the credential/config requirements declared in SKILL.md and the runtime instructions encourage broad automatic use — review code (especially submit-draft.js) and the credential handling before installing.

Purpose & Capability

The declared purpose (full WeChat article workflow including submitting drafts) is consistent with the shipped scripts (temp-convert.js, submit-draft.js, humanize/detect/style scripts) and npm dependencies (puppeteer). However the registry metadata lists no required environment variables or config paths while the SKILL.md explicitly requires WECHAT_APPID and WECHAT_APPSECRET to be stored in ~/.openclaw/env and instructs adding the server IP to WeChat's whitelist. That mismatch between metadata and runtime requirements is an incoherence that could surprise users.

Instruction Scope

SKILL.md contains detailed runtime instructions that stay within the stated purpose (collect, humanize, render HTML to images, and submit drafts). Two notable items: (1) it tells the agent to '立即使用此技能' when users mention article-related topics — a broad trigger phrase that may cause frequent/automatic invocation; (2) it mandates storing credentials in ~/.openclaw/env and running detection/humanize scripts every time. Both are within scope for the skill's goal, but give the skill broad discretion and require access to a credentials file — the agent or operator should confirm how those credentials are read and protected.

Install Mechanism

There is no platform-level install spec, but SKILL.md instructs running `npm install` in the skill folder. package.json depends on puppeteer and commander (both from npm). This is a typical Node-based install; note that puppeteer downloads browser binaries and may require Node >= 18 (some puppeteer/browser packages in package-lock indicate Node >=18). No external arbitrary download URLs or obscure installers were observed in the provided files.

Credentials

The SKILL.md legitimately requires WECHAT_APPID and WECHAT_APPSECRET (which are proportional to a skill that submits drafts via the WeChat API). However, the registry metadata advertised to the platform lists no required env vars nor required config paths — this is inconsistent. The SKILL.md also specifies a concrete filesystem location (~/.openclaw/env) for credentials, which implies the skill will read that file at runtime; the metadata should have declared this. The number and sensitivity of required secrets (AppSecret) are reasonable, but the omission from metadata is a red flag and should be corrected/verified. Also inspect submit-draft.js to confirm it only uses the WeChat API and does not send credentials elsewhere.

Persistence & Privilege

The skill is not marked always:true and does not request special system privileges. It does instruct adding the runtime server IP to the WeChat IP whitelist (expected for WeChat API calls). One operational note: SKILL.md tells the agent to 'immediately use' this skill when users mention related topics — combined with normal autonomous invocation this could lead to more frequent automatic activations than a user expects. This is behavioral (invocation scope) rather than an install-time privilege, but worth awareness.

What to consider before installing

This skill appears to implement the described WeChat article pipeline and ships scripts to humanize text, generate images, and submit drafts. However: (1) SKILL.md requires WECHAT_APPID and WECHAT_APPSECRET to be placed in ~/.openclaw/env, but the registry metadata does not declare those required env vars — confirm and correct metadata before installing. (2) Review scripts/submit-draft.js (and any network calls) to verify it only contacts the WeChat API and does not leak credentials to other endpoints. (3) npm install will pull puppeteer and many npm packages; ensure you run it in an isolated environment and are prepared for browser binaries (Node >=18 may be required). (4) Consider restricting automatic invocation: the SKILL.md's instruction to 'immediately use' on any article-related mention is broad — if you don't want the agent to run this skill automatically, disable autonomous invocation or require explicit user confirmation before submission. (5) Store AppSecret securely, run the skill on a server/IP you control (for WeChat IP whitelist), and rotate credentials after testing. If you want a higher confidence verdict, provide the full submit-draft.js source and confirm how environment variables are read at runtime.

---

name: article-factory-wechat description: 微信公众号文章生产全流程工具，提供从选题搜集、深度调研、撰写文章、去AI味、生成配图、HTML排版到提交草稿的完整7步标准化流程。当用户提到写公众号文章、发文章、文章选题、公众号草稿、文章配图、文章排版、去除AI痕迹、提交公众号等任何相关需求时，立即使用此技能。

公众号文章生产 SOP（7步流程）

完整流程

Step 1: 信息搜集 → Step 2: 深度调研 → Step 3: 撰写文章
    ↓
Step 4: 去AI味 → Step 5: 生成配图 → Step 6: HTML排版 → Step 7: 提交草稿

---

各步骤详细说明

请只在执行到对应步骤的时候才浏览对应步骤的具体说明。

• Step 1: 信息搜集 - 从可用信息源获取真实事件，提炼3个选题
• Step 2: 深度调研 - 确定选题后，收集足够素材支撑文章
• Step 3: 撰写文章 - 写出符合公众号风格的高质量文章
• Step 4: 去AI味 - 使用humanize-chinese技能优化文章，去除AI痕迹
• Step 5: 生成配图 - 使用HTML模板生成封面图、文章配图、流程图等
• Step 6: HTML排版 - 将文章转为美观的HTML格式，适配公众号
• Step 7: 提交草稿 - 检查并提交到公众号草稿

---

凭证要求（必须配置）

环境变量

在 ~/.openclaw/env 中配置以下密钥：

WECHAT_APPID=你的微信公众号AppID
WECHAT_APPSECRET=你的微信公众号AppSecret

获取方式： 登录微信公众平台 → 开发 → 开发管理 → 基本配置

微信公众号 IP 白名单

将运行此技能的服务器 IP 地址添加到微信公众平台的 IP 白名单，否则接口调用会失败。

---

依赖技能

本技能依赖以下已安装技能：

技能	用途
humanize-chinese	（可选）文章去AI味检测与优化
multi-search-engine	选题阶段的信息搜索

---

外部工具集成

工具	用途	凭证要求
微信公众号 API	发布草稿	WECHAT_APPID + WECHAT_APPSECRET
飞书云文档	文章审阅分享	通过 OpenClaw 飞书插件，无需额外配置
Puppeteer（本地）	HTML 转图片	无需配置，脚本内置

---

使用前提

npm 依赖安装

首次使用前需要安装依赖：

cd skills/article-factory-wechat && npm install

---

关键文件路径

内容	路径
输出目录	工作区/work/output/{YYYYMMDD}-{文章标题}/
脚本	scripts/
HTML模板	templates/
参考文档	references/

输出目录规范

所有产物统一输出到：

工作区/work/output/{YYYYMMDD}-{文章标题}/

• YYYYMMDD：当前日期（如 20260321）
• 文章标题：文章的标题
• 示例：workspace/work/output/20260321-AI-新模型评测/

⚠️ 常见错误

1. 图片不能省略 — 封面图 + 文章配图都是必须步骤
2. 去AI味必须做 — 每次都要跑检测脚本，不能跳过
3. 用户审阅后再提交 — 将结果发给用户，确认后再提交草稿（若为飞书渠道，请发送飞书文档）
4. 必须用 HTML 模板生图 — 封面图和配图必须用 temp-convert.js + HTML 模板方式