jike-wechat-writer

提供微信公众号文章创作全流程指导，支持选题挖掘、风格拆解、正文写作、配图策略及排版样式应用。

Security Scan

The skill's code and runtime instructions mostly match a WeChat-article authoring tool, but there are several mismatches and unexplained external endpoints (an API host and hosted assets) and metadata inconsistencies that warrant caution before installing or supplying credentials.

Purpose & Capability

The declared purpose (WeChat article creation: topic discovery, style analysis, writing, image strategy, rendering) aligns with the included scripts (writer.py and render.py) and reference docs. The scripts legitimately call an external API for trend/search/style/image capabilities and render local Markdown to HTML, which fits the stated functionality. However, the skill metadata in the top-level registry claims no required env vars/binaries while SKILL.md's embedded metadata requires python3 and a primaryEnv of 100CITY_API_KEY — an inconsistency between what the skill says it needs and what the registry lists.

Instruction Scope

Instructions direct the agent to run the included Python scripts, read and write local files (MEMORY.md, article .md files, scripts/config.json), call web_fetch for external content, and only perform image generation/search via writer.py. All of those are coherent with an authoring workflow. The policy that the skill must stop if the API key is not configured is explicit. Nothing in SKILL.md instructs reading unrelated system files, but it does require the agent to use file read/write operations and to call external APIs — expected, but material to user privacy and network use.

Install Mechanism

No install spec is present; the skill is instruction + included Python scripts. That minimizes installer risk (no arbitrary installers/downloads). The scripts are pure Python and use only stdlib (urllib, json, etc.).

Credentials

The runtime requires an API key (100CITY_API_KEY) and optionally 100CITY_BASE_URL (or config.json). Requesting a single service API key is proportional to the described remote capabilities. But the top-level registry incorrectly lists no required env vars while SKILL.md explicitly names 100CITY_API_KEY as primaryEnv — this metadata mismatch is concerning. The default base_url in config.json is https://gin-test.100.city/api and asset hosts referenced in styles/render are external (e.g., qiniu-cloud.dso100.com, file.dso100.com). Those domains are not documented in the skill description; you should verify the legitimacy of the 100.city service and the external asset hosts before supplying credentials.

Persistence & Privilege

The skill does not request always:true and does not modify other skills or system-wide settings. It will read and write files within the skill directory (styles/, MEMORY.md, article .md), which is expected for this workflow. It does record theme IDs and style reports into MEMORY.md per instructions — that is local persistence for the skill's purposes.

What to consider before installing

This skill appears to implement the advertised WeChat-article workflow, but take these precautions before installing or entering secrets: - Metadata mismatch: the registry claims no required env vars/binaries, but SKILL.md and the scripts require python3 and an API key named 100CITY_API_KEY. Treat that mismatch as a red flag: ask the publisher/maintainer to clarify and correct the metadata. - Verify the API host: the default API base_url is https://gin-test.100.city/api (and scripts will call that service). Confirm that the 100.city service (and the 'gin-test' host) is legitimate and that you trust it with any API key you provide. If unsure, do not provide any production credentials. - Use a scoped or throwaway key first: if you want to test, create a limited-scope API key or a test account, not a high-privilege or production credential. The scripts use the key as a Bearer token for API calls. - Inspect network activity: the scripts contact external services (API host and some asset hosts like qiniu-cloud.dso100.com and file.dso100.com). If you run the skill, do so in a network-monitored or sandboxed environment first to observe outbound endpoints. - Review file writes: the skill reads/writes MEMORY.md and article .md files and may save themes under styles/. If you have sensitive local files named MEMORY.md in your environment, ensure they are appropriate for the skill to read. - If you need higher assurance, ask the publisher for provenance (who published it), a canonical homepage/repo, and confirmation that the base_url and asset hosts are official. Correcting the registry metadata (declared required env vars and binaries) would significantly raise confidence. Given the above, proceed cautiously: the code itself does not show clear exfiltration of arbitrary files, but the external API endpoints and metadata inconsistencies justify further verification before granting credentials or enabling the skill broadly.

微信公众号文章创作技能

Script: python3 {baseDir}/scripts/writer.py

本技能为微信公众号文章创作提供全流程的核心指导。它不是一个必须从头走到尾的线性工作流，而是由多个独立模块组成的创作指导集——agent 应根据用户当前所处的创作阶段和实际需求，灵活调用对应模块。

核心规则

1. API Key 未配置 = 技能不可用，必须停止一切创作动作

• 技能激活后第一步必须执行 python3 {baseDir}/scripts/writer.py check 确认 Key 配置状态。
• 如果 check 失败：立即停止，只做一件事——告诉用户需要配置 Key，给出配置方法，然后等待用户完成配置。 不要读模块文档，不要搜索热点，不要分析选题，不要用网络搜索替代，不要做任何创作相关的事情。
• 没有 Key 就没有热点聚合搜索、没有风格拆解、没有图片生成——整个创作流程无法运行，用网络搜索凑出来的内容不符合本技能的质量标准。

2. 通过脚本调用 API — skill内的能力通过 writer.py和 render.py 脚本调用，因为脚本封装了 API 认证、错误处理和格式化输出，直接 curl 会缺少这些保障。
3. API 失败最多重试 1 次 — 同一个接口连续失败 2 次后停止重试，告知用户原因并给出替代方案，避免无意义的等待。

API Key Setup

编辑 {baseDir}/scripts/config.json，填写 api_key。或设置环境变量 100CITY_API_KEY。

快速检查：python3 {baseDir}/scripts/writer.py check

Script Quick Reference

# 检查连接
python3 {baseDir}/scripts/writer.py check

# 统一搜索（news/wechat_article/image）
python3 {baseDir}/scripts/writer.py search --query "关键词" --action news
python3 {baseDir}/scripts/writer.py search --query "关键词" --action wechat_article

# 获取最新热点新闻
python3 {baseDir}/scripts/writer.py trend

# 关键词热点总结
python3 {baseDir}/scripts/writer.py trend-summary --keyword "关键词"

# 按公众号名称拆解创作风格
python3 {baseDir}/scripts/writer.py style-by-name --name "公众号名称"

# 按文章链接拆解创作风格
python3 {baseDir}/scripts/writer.py style-by-url --url "文章链接"

# AI 生成图片
python3 {baseDir}/scripts/writer.py generate-image --prompt "图片描述"
python3 {baseDir}/scripts/writer.py generate-image --prompt "图片描述" --ratio 16:9
python3 {baseDir}/scripts/writer.py generate-image --prompt "图片描述" --ref-url "参考图URL"

所有命令支持 --json 获取原始 JSON 输出。

Script: python3 {baseDir}/scripts/render.py

# 渲染 MD 为带样式的 HTML（微信公众号排版）
python3 {baseDir}/scripts/render.py render article.md --theme blue-minimal -o article.html

# 查看可用主题
python3 {baseDir}/scripts/render.py list-themes

# 从公众号文章链接拆解排版样式
python3 {baseDir}/scripts/render.py extract-style "https://mp.weixin.qq.com/s/xxxxx" --name "主题名" --id theme-id

模块总览

模块	职责	何时激活	详细文档
A. 选题与方向确认	从上下文中提炼创作方向	创作起点，每次必经	{baseDir}/references/module-a-topic.md
B. 记忆适配	读取用户行业背景、品牌资产与创作历史	MEMORY.md 或 MEMORY/ 目录存在时	{baseDir}/references/module-b-memory.md
C. 风格遵循	获取并遵循目标公众号的创作风格	选题确认后、正文创作前	{baseDir}/references/module-c-style.md
D. 正文创作与迭代	产出 MD 文件并与用户迭代	核心创作环节	{baseDir}/references/module-d-writing.md
E. 配图策略	将占位标记替换为真实图片	文案确认后、渲染排版前	{baseDir}/references/module-e-image.md
F. 公众号样式应用	通过 render.py 生成带排版样式的 HTML，支持从公众号文章拆解自定义样式	用户要求公众号排版样式时	{baseDir}/references/module-f-styling.md

进入某个模块的详细执行时，读取对应的 reference 文件获取完整指导。

模块间协作关系

用户发起创作请求
    │
    ▼
[模块 A] 选题与方向确认 ← 创作入口
    │
    ├── 存在 MEMORY.md / MEMORY/ ？──→ [模块 B] 记忆适配（隐式融入创作）
    │
    ▼
[模块 C] 风格确认 ← 选题确认后、正文创作前
    │   检查 MEMORY.md 是否有风格偏好
    │   ├── 有 → 读取风格报告，遵循创作
    │   ├── 无 → 询问用户是否模仿某公众号
    │   │       ├── 用户提供名称/链接 → 拆解风格 → 保存到 MEMORY.md
    │   │       └── 用户不需要 → 使用公众号爆文默认风格
    │
    ▼
[模块 D] 正文创作与迭代 ← 核心环节（在风格框架确定后开始）
    │   D2 撰写时在配图位置插入 <!-- IMG: 描述 --> 占位
    │
    ├── 用户确认文案 ──→ 可选：进入配图
    │
    ├── 用户要求公众号样式？──→ [模块 F] 公众号样式应用（render.py，占位图自动填充）
    │
    ▼
[模块 E] 配图策略（read .md → 扫描占位 → search/generate → 替换为真实图片）
    │   ⚠️ 消耗算力，仅在用户明确要求时执行
    │
    ├── 配图完成后可重新执行模块 F 渲染最终版
    │
    └── 创作完成

模块执行说明

• 模块 A 和模块 C 是正文创作前的两个关键环节，因为选题方向和风格框架直接决定了正文质量
• 模块 C 的三种结果（已有风格 / 拆解新风格 / 爆文默认风格）都会产出一套明确的写作框架，模块 D 在此框架下创作
• 模块 B 不产出独立交付物，隐式融入创作过程
• 模块 C 的配图习惯会传递给模块 D（占位描述）和模块 E（图片风格选择）
• 模块 D 专注文案质量，配图以占位标记形式预留位置；模块 E 在用户明确要求时执行配图替换（消耗算力，不擅自执行）
• 模块 F 不要求配图完成——.md 中的 <!-- IMG: --> 占位标记会被渲染为占位图片并保留描述文字，后续可随时配图后重新渲染
• 整个流程中，用户随时可以要求回到任意模块进行调整