{"items":[{"id":"cmugwhm9p019tqu06v3a71p4x","slug":"geekjourneyx-md2wechat-skill-md2wechat","name":"md2wechat","description":"Convert Markdown to WeChat Official Account HTML. Use this whenever the user wants WeChat article formatting, article preview, WeChat draft upload, image generation for articles, cover or infographic generation, image-post creation, writer-style drafting, title suggestions, AI trace removal, or current discovery of supported providers, themes, prompts, and layout modules. Also use for unpublished Zhihu, CSDN, Toutiao, or Tencent Cloud Developer Community drafts through a browser. Use for product introductions, encyclopedia articles or entry drafts, and writing tailored to platforms or search targets.","authorId":"gh:geekjourneyx","authorName":"geekjourneyx","version":"0.1.0","category":"Prompt","securityLevel":"Sandbox","downloadsCount":0,"githubStars":3670,"pricePerCall":0,"manifest":{"name":"md2wechat","tools":[],"category":"Prompt","entrypoint":{"type":"prompt"},"description":"Convert Markdown to WeChat Official Account HTML. Use this whenever the user wants WeChat article formatting, article preview, WeChat draft upload, image generation for articles, cover or infographic generation, image-post creation, writer-style drafting, title suggestions, AI trace removal, or current discovery of supported providers, themes, prompts, and layout modules. Also use for unpublished Zhihu, CSDN, Toutiao, or Tencent Cloud Developer Community drafts through a browser. Use for product introductions, encyclopedia articles or entry drafts, and writing tailored to platforms or search targets.","permissions":[],"systemPrompt":"# md2wechat\n\nUse this skill to operate the `md2wechat` CLI. Keep the skill focused on execution decisions. For full command tutorials, installation details, and FAQ-level explanations, refer users to the project docs instead of expanding this runtime protocol.\n\n## Intent Routing\n\nChoose the command family before taking any publish or generation action:\n\n- Standard article HTML, article preview, metadata inspection, or WeChat article draft: use `inspect`, `preview`, and `convert`.\n- Unpublished Zhihu, CSDN, Toutiao, or Tencent Cloud Developer Community draft: run `md2wechat skills read md2wechat references/sync/workflow.md --json` for the current CLI's embedded workflow; the CLI prepares content and the Agent operates the browser.\n- Image-first post, image note, image-text note, `newspic`, or multi-image post: use `create_image_post`, not `convert --draft`.\n- Article cover or article infographic: prefer `generate_cover` or `generate_infographic` over raw `generate_image` when a bundled preset fits.\n- Host-agent image generation request with no provider configured: use image plan mode (`--plan --json`) to get prompt intent, then hand it to the host image-generation tool if one is available outside md2wechat.\n- WeChat title candidates for an existing article: use `title suggest --json`; it emits a host-Agent AI request and does not choose or write the final title.\n- Product introductions, encyclopedia articles or entry drafts, and platform/search-directed writing: read `md2wechat skills read md2wechat references/writing/workflow.md --json` and follow it as the host Agent. Prefer this route over `advise` or `write` for these requests; skip it for formatting-only tasks.\n- Existing article or draft, user asks what to improve next: run `md2wechat advise --json`; treat it as recommendation-only and keep `inspect --json data.readiness.targets/blockers` as the publish gate.\n- Writing in a creator style or removing AI traces: use `write` or `humanize`.\n- Provider, theme, prompt, or layout uncertainty: run discovery first. Do not guess from memory or repository files.\n\nTreat `convert --draft` and `create_image_post` as different publish targets, not interchangeable variants.\n\n## Discovery First\n\nUse CLI discovery as the source of truth, but keep it scoped to the next decision. Do not run the full catalog for tasks that do not need provider, theme, prompt, or layout selection.\n\nUse `capabilities` for aggregate routing facts, resource `list` for lightweight selection fields, `show` for one full resource definition, and `render` for materialized prompt/layout output. JSON stdout is compact; use `jq` only when a human needs formatted output.\n\nRun the smallest useful discovery set:\n\n- Article formatting with no theme or modules chosen:\n ```bash\n md2wechat themes list --json\n md2wechat layout list --json\n ```\n\n- A named theme, provider, prompt, or layout module:\n ```bash\n md2wechat themes show --json\n md2wechat providers show --json\n md2wechat prompts show --kind --json\n md2wechat layout show --json\n ```\n\n- Image generation or image-preset selection:\n ```bash\n md2wechat providers list --json\n md2wechat prompts list --kind image --json\n ```\n\n- Subject-reference (image-to-image) capability before using `--subject-reference`:\n ```bash\n md2wechat providers show minimax --json\n ```\n Read `supports_subject_reference` on the provider and on each entry of `supported_models`. Only the `minimax` provider and its `image-01` model accept `--subject-reference`, and the reference must be a publicly reachable `http(s)` portrait image URL; inline data URLs and local paths are rejected. Unsupported provider/model combinations fail immediately with `CONFIG_INVALID`, so do not retry them as generation failures.\n\n- Title suggestion prompt selection:\n ```bash\n md2wechat prompts list --kind title --json\n md2wechat prompts show wechat-title-expert --kind title --json\n ```\n\n- Draft, upload, API local-readiness, or configuration troubleshooting:\n ```bash\n md2wechat doctor --json\n md2wechat config show --format json\n md2wechat config wechat-accounts --json\n ```\n `doctor` readiness is local configuration attemptability. `config wechat-accounts` is local-only and never prints WeChat secrets. Use `inspect --json` for article-specific target readiness.\n\n- Unknown CLI version, changed behavior, or capability uncertainty:\n ```bash\n md2wechat version --json\n md2wechat capabilities --json\n md2wechat skills list --json\n md2wechat skills read md2wechat --json\n ```\n\n`md2wechat skills read md2wechat --json` reads the SOP embedded in the current CLI binary. Prefer it when the installed external skill, README, or repository checkout may be stale relative to the executable on `PATH`.\n\nFor simple local actions such as `preview`, `humanize`, or a user-specified command with explicit flags, do not run unrelated provider, theme, prompt, or layout discovery.\n\nInspect specific resources only when the task needs them:\n\n```bash\nmd2wechat providers show --json\nmd2wechat themes show --json\nmd2wechat prompts show --kind --json\nmd2wechat layout show --json\n```\n\nUse CLI output as the source of truth for currently available modes, providers, themes, prompts, and layout modules.\n\n## Configuration Boundaries\n\n- Assume `md2wechat` is already available on `PATH`.\n- `convert` defaults to API mode unless the user explicitly asks for `--mode ai`.\n- API-mode preview and conversion require a valid `MD2WECHAT_API_KEY`.\n- WeChat upload, article draft creation, and `create_image_post` require WeChat credentials whenever the user explicitly requests those side effects.\n- Read-only discovery, `inspect`, `preview`, and plain conversion are free of any global WeChat publishing credential requirement; API-mode preview and conversion still require a valid `MD2WECHAT_API_KEY`.\n- Named WeChat account execution requires a valid `MD2WECHAT_API_KEY`; the CLI validates it before upload, draft, or `create_image_post` effects.\n- Direct image generation requires image-provider credentials; image plan mode (`--plan --json`) only emits prompt intent for a host Agent or external tool and does not require image-provider credentials.\n- `title suggest --json` only emits a title-generation prompt request for the host Agent or external model. It does not call a model, upload, create drafts, or write back to Markdown.\n- For stronger factual title hooks, pass --hook-level 2 or 3; do not treat generated titles as confirmed publishing intent.\n- `doctor --json` is local-only: it checks local readiness and does not perform live authentication, upload images, or create drafts.\n- Use `config show --format json` when the user asks what configuration is currently effective.\n- Use `config wechat-accounts --json` when the user asks which local WeChat accounts are configured.\n\n## Article Workflow\n\nPrefer a confirm-first workflow for article work:\n\n1. `md2wechat inspect --json`\n2. `md2wechat preview `\n3. `md2wechat convert ...`\n4. Add `--upload`, `--draft`, `--cover`, or `--cover-media-id` only when the user explicitly asks for upload or draft creation.\n\n`inspect` is the source-of-truth command for structured metadata, checks, readiness targets, and blockers. In `--json` output, read `data.readiness.targets` and `data.readiness.blockers` before deciding whether `convert`, `upload`, or `draft` is blocked. If the requested target is blocked, stop and report the matching blockers; do not continue by guessing from legacy booleans or `checks` alone. Do not invent `data.agent_readiness`, `data.target_readiness`, `ArticleState`, state files, or a second readiness/state object. `preview` writes only byte-identical final API HTML from a successful converter result; with `--json`, inspect diagnostics are returned in `data.inspect` and are never wrapped into that file. It does not upload images, create drafts, or write back to Markdown. `convert` performs conversion and only the explicitly requested upload/draft effects. `convert --preview` is the convert-path preview flag and is not the same as the standalone `preview` command. On `PREVIEW_ACTION_REQUIRED` or `PREVIEW_FAILED`, this invocation does not create or overwrite preview HTML. With `--json`, `PREVIEW_ACTION_REQUIRED` returns an empty `data.output_file`. Any pre-existing explicit output path is stale and must not be treated as this invocation's result; use the returned prompt for host-Agent work or report the failure.\nWhen the intended execution path is `convert --mode ai --custom-prompt ...`, run `inspect` with the same `--mode ai --custom-prompt ...` before trusting readiness.\n\n## Formatting Protocol\n\nWhen the user asks to format an article and has not chosen a theme or modules:\n\n1. Read the article and optional Brand Profile.\n2. Use discovery output as facts.\n3. Choose a compatible theme and a small set of modules from the article's content goal.\n4. Keep the source Markdown read-only.\n5. Create a temporary formatted Markdown artifact, for example `/tmp/md2wechat-format//article.formatted.md`.\n6. Insert only layout modules whose required fields can be filled correctly.\n7. Run `md2wechat layout validate --file --json`.\n8. Pass the formatted Markdown artifact to `convert`.\n\nSaving generated Markdown next to the source file requires explicit user confirmation and must not overwrite the source.\n\n## Theme Selection\n\n- Read `type` and `selectable` from `themes list --json`.\n- API mode can use only `type: api` and `selectable: true` themes.\n- AI mode can use only `type: ai` and `selectable: true` themes.\n- Do not use collection descriptors such as non-selectable theme groups as concrete themes.\n- If Brand Profile names a theme, verify it through CLI discovery before using it.\n- If a requested theme is invalid or mode-incompatible, stop that path and choose a valid theme or ask the user.\n\n## Layout Modules\n\nAdvanced layout modules render only in API mode. AI mode (`--mode ai`) does not parse `:::module` syntax, so advanced layout cards will not render there.\n\nUse this decision frame:\n\n- `attention`: help readers decide whether the article is worth reading.\n- `readability`: make mobile reading easier.\n- `memorability`: make one judgment, quote, metric, or brand anchor stick.\n- `conversion`: help readers save, follow, inquire, share, or buy.\n\nUse CLI discovery as the source of truth for layout syntax instead of memorizing or guessing `body_format` values:\n\n- Inspect the opener, body schema, canonical executable example, and structurally distinct variants with `layout show --json`. Reuse the canonical witness.\n- Use `layout render` for structured fields and `--body-file` (or `--body-file -` for stdin) for complex bodies, then validate the generated Markdown.\n- Default discovery returns recommended modules. Use `layout list --lifecycle compatibility --json` only for old-content migration. Local validation proves syntax acceptance only; production support is a release-conformance fact.\n- `gallery` is recommended. For `expand`, pass header fields, a standalone `---`, and Markdown body through `--body-file`. `cover-reveal` and `expand` default to complete static output; use `first-layer` only when the user explicitly requests an interaction candidate, and verify the target API before relying on it.\n\nDefault module discipline:\n\n- Do not pile on modules.\n- Use at most one hero, one verdict, and one cta unless the user explicitly asks for more.\n- Skip modules when the article does not provide enough content to fill them honestly.\n\n## API And AI Mode\n\n- API mode is the default and is required for advanced layout modules.\n- AI mode is a lighter path and does not render advanced layout modules.\n- Do not silently switch from API mode to AI mode after an API failure. That changes the output capability.\n- Use AI mode only when the user asks for it or accepts losing advanced layout rendering.\n- If an AI-mode conversion completes, it is acceptable to briefly mention that API mode supports advanced layout modules and stronger visual structure.\n\n## Brand Profile\n\nBrand Profile lives at `~/.config/md2wechat/brand.md`.\n\n- It is free-form Markdown, not YAML and not a fixed schema.\n- The CLI does not parse it.\n- Read it as context for voice, theme preferences, module preferences, CTA preferences, and forbidden expressions.\n- Treat quantity preferences as soft constraints.\n- Verify any named theme or module through CLI discovery.\n- If Brand Profile does not exist, do not block the task. You may mention once that system defaults will be used.\n- Create or edit Brand Profile only when the user explicitly asks.\n\n## Publishing Side Effects\n\nDo not create drafts, upload images, publish, or call remote image generation unless the user asks for that action.\n\nBefore every explicit WeChat side effect—image upload, article draft creation, or `create_image_post`—require configured WeChat credentials and use the target-matched readiness/preflight path. Discovery and inspection remain non-publishing paths; preview and plain conversion are free of any global WeChat publishing credential requirement, while API mode still requires a valid `MD2WECHAT_API_KEY`.\n\nBefore WeChat article draft creation through `convert`:\n\n- Use `inspect --json` and check `data.readiness.targets.draft`; when blocked, read matching `data.readiness.blockers`.\n- Draft creation requires a cover via `--cover` or `--cover-media-id`.\n- Do not assume a WeChat URL or `mmbiz.qpic.cn` URL can be reused as `thumb_media_id`.\n- If draft creation returns `45004`, check digest, summary, and description before assuming the body is too long.\n\nIn the WeChat `convert` flow, Markdown images are uploaded or replaced only during `--upload` or `--draft`, not during plain conversion or preview.\n\n## Failure Handling\n\n- Missing or invalid config: run `doctor --json` and `config show --format json`; report `data.overall` plus the blocking `data.readiness.*` item.\n- Invalid layout syntax: run `layout validate`, inspect the failing module with `layout show`, fix the generated artifact, then validate again.\n- Unknown layout modules warn for forward compatibility; verify typos against `layout list --json`.\n- Theme rejection: check `type` and `selectable`, then choose a compatible theme or ask the user.\n- AI request or style-writing flows may return a prompt/request rather than final prose or HTML unless the external model step is completed.","schemaVersion":1},"repoUrl":"https://github.com/geekjourneyx/md2wechat-skill/tree/main/skills/md2wechat","tags":["agent-cli","ai-agent","ai-writing","claude-code","claude-skills","cli","go","markdown","markdown-converter","markdown-formatter","markdown-to-html","markdown-to-wechat"],"stats":{"installVelocity7d":0,"retentionRate":0,"executions":0,"rating":null},"origin":"github","source":{"repo":"md2wechat-skill","audit":{"files":["go.mod","go.sum","package.json"],"binaries":[],"findings":[{"kind":"dependency","rule":"DP-02","message":"`postinstall` script runs on every install.","surface":"package.json","evidence":"postinstall: node scripts/install.js","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"github.com/disintegration/imaging@v1.6.2 has a known vulnerability: Crash when processing crafted TIFF files.","surface":"go.mod, go.sum, package.json","evidence":"GHSA-q7pp-wcgr-pffx · Go:github.com/disintegration/imaging@v1.6.2","severity":"low"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8 has a known vulnerability: Go Images vulnerable to an out-of-memory error via a crafted TIFF file.","surface":"go.mod, go.sum, package.json","evidence":"GHSA-44p7-9xx4-hf2g · Go:golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8","severity":"medium"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8 has a known vulnerability: Panic when parsing invalid palette-color images in golang.org/x/image.","surface":"go.mod, go.sum, package.json","evidence":"GHSA-9phm-fm57-rhg8 · Go:golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8 has a known vulnerability: Golang TIFF decoder vulnerable to excessive CPU consumption.","surface":"go.mod, go.sum, package.json","evidence":"GHSA-j3p8-6mrq-6g7h · Go:golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8","severity":"medium"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8 has a known vulnerability: golang.org/x/image/tiff has excessive resource consumption in PackBits decompression.","surface":"go.mod, go.sum, package.json","evidence":"GHSA-q675-qj96-32m9 · Go:golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8 has a known vulnerability: Uncontrolled Resource Consumption in golang.org/x/image.","surface":"go.mod, go.sum, package.json","evidence":"GHSA-qgc7-mgm3-q253 · Go:golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8","severity":"medium"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8 has a known vulnerability: Golang TIFF decoder does not place a limit on the size of compressed tile data.","surface":"go.mod, go.sum, package.json","evidence":"GHSA-x92r-3vfx-4cv3 · Go:golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8","severity":"medium"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8 has a known vulnerability: Denial of service via crafted TIFF image in golang.org/x/image/tiff.","surface":"go.mod, go.sum, package.json","evidence":"GO-2023-1572 · Go:golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8 has a known vulnerability: Excessive resource consumption in golang.org/x/image/tiff.","surface":"go.mod, go.sum, package.json","evidence":"GO-2023-1989 · Go:golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8 has a known vulnerability: Excessive CPU consumption when decoding 0-height images in golang.org/x/image/tiff.","surface":"go.mod, go.sum, package.json","evidence":"GO-2023-1990 · Go:golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2024-2937 · Go:golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-4815 · Go:golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-4961 · Go:golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-4962 · Go:golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-5031 · Go:golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-5032 · Go:golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-5061 · Go:golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-5062 · Go:golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-5066 · Go:golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-6222 · Go:golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/net@v0.38.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GHSA-5cv4-jp36-h3mw · Go:golang.org/x/net@v0.38.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/net@v0.38.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-4440 · Go:golang.org/x/net@v0.38.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/net@v0.38.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-4441 · Go:golang.org/x/net@v0.38.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/net@v0.38.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-4918 · Go:golang.org/x/net@v0.38.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/net@v0.38.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-5025 · Go:golang.org/x/net@v0.38.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/net@v0.38.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-5026 · Go:golang.org/x/net@v0.38.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/net@v0.38.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-5027 · Go:golang.org/x/net@v0.38.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/net@v0.38.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-5028 · Go:golang.org/x/net@v0.38.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/net@v0.38.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-5029 · Go:golang.org/x/net@v0.38.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/net@v0.38.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-5030 · Go:golang.org/x/net@v0.38.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/net@v0.38.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-5942 · Go:golang.org/x/net@v0.38.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"github.com/sirupsen/logrus@v1.9.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GHSA-4f99-4q7p-p3gh · Go:github.com/sirupsen/logrus@v1.9.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"github.com/sirupsen/logrus@v1.9.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2025-4188 · Go:github.com/sirupsen/logrus@v1.9.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GHSA-45gg-vh54-h5m9 · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GHSA-5cgq-3rg8-m6cv · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GHSA-78mq-xcr3-xm33 · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GHSA-89gr-r52h-f8rx · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GHSA-9m57-25v3-79x9 · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GHSA-f5wc-c3c7-36mc · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GHSA-f6x5-jh6r-wrfv · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GHSA-j5w8-q4qc-rx2x · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GHSA-jppx-rxg9-jmrx · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GHSA-q4h4-gmj2-qvw2 · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GHSA-qpw4-5x99-6vjp · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GHSA-rm3j-f69w-wqmq · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GHSA-vgwf-h737-ff37 · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GHSA-w879-237q-wc7r · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GHSA-x527-x647-q7gg · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2025-4116 · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2025-4134 · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2025-4135 · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-5005 · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-5006 · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-5013 · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-5014 · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-5015 · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-5016 · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-5017 · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-5018 · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-5019 · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-5020 · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-5021 · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-5023 · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-5033 · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-5932 · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-6303 · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-6354 · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-6355 · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/text@v0.23.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-5970 · Go:golang.org/x/text@v0.23.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"google.golang.org/grpc@v1.66.2 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GHSA-2v4p-qf9q-27wj · Go:google.golang.org/grpc@v1.66.2","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"google.golang.org/grpc@v1.66.2 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GHSA-hrxh-6v49-42gf · Go:google.golang.org/grpc@v1.66.2","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"google.golang.org/grpc@v1.66.2 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GHSA-p77j-4mvh-x3m3 · Go:google.golang.org/grpc@v1.66.2","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"google.golang.org/grpc@v1.66.2 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GHSA-qc2q-p7wx-3px3 · Go:google.golang.org/grpc@v1.66.2","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"google.golang.org/grpc@v1.66.2 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GHSA-vp52-pcj8-j9qc · Go:google.golang.org/grpc@v1.66.2","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"google.golang.org/grpc@v1.66.2 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-4762 · Go:google.golang.org/grpc@v1.66.2","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"google.golang.org/grpc@v1.66.2 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-6061 · Go:google.golang.org/grpc@v1.66.2","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"google.golang.org/grpc@v1.66.2 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-6348 · Go:google.golang.org/grpc@v1.66.2","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"google.golang.org/grpc@v1.66.2 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-6441 · Go:google.golang.org/grpc@v1.66.2","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"google.golang.org/grpc@v1.66.2 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-6443 · Go:google.golang.org/grpc@v1.66.2","severity":"high"}],"packages":36,"auditedAt":"2026-09-25T11:51:48.601Z","lockfiles":["go.sum"]},"forks":413,"owner":"geekjourneyx","stars":3670,"topics":["agent-cli","ai-agent","ai-writing","claude-code","claude-skills","cli","go","markdown","markdown-converter","markdown-formatter","markdown-to-html","markdown-to-wechat","mcp-server","md2wechat","wechat","wechat-article","wechat-mp","wechat-official-account","wechat-public-account","weixin"],"license":null,"fullName":"geekjourneyx/md2wechat-skill","homepage":"https://md2wechat.cn","language":"Go","pushedAt":"2026-09-24T08:59:11Z","avatarUrl":"https://avatars.githubusercontent.com/u/24422856?v=4","crawledAt":"2026-09-25T11:51:44.524Z","openIssues":5,"manifestFile":"SKILL.md","manifestPath":"skills/md2wechat/SKILL.md","defaultBranch":"main"},"readme":"# md2wechat\n\nUse this skill to operate the `md2wechat` CLI. Keep the skill focused on execution decisions. For full command tutorials, installation details, and FAQ-level explanations, refer users to the project docs instead of expanding this runtime protocol.\n\n## Intent Routing\n\nChoose the command family before taking any publish or generation action:\n\n- Standard article HTML, article preview, metadata inspection, or WeChat article draft: use `inspect`, `preview`, and `convert`.\n- Unpublished Zhihu, CSDN, Toutiao, or Tencent Cloud Developer Community draft: run `md2wechat skills read md2wechat references/sync/workflow.md --json` for the current CLI's embedded workflow; the CLI prepares content and the Agent operates the browser.\n- Image-first post, image note, image-text note, `newspic`, or multi-image post: use `create_image_post`, not `convert --draft`.\n- Article cover or article infographic: prefer `generate_cover` or `generate_infographic` over raw `generate_image` when a bundled preset fits.\n- Host-agent image generation request with no provider configured: use image plan mode (`--plan --json`) to get prompt intent, then hand it to the host image-generation tool if one is available outside md2wechat.\n- WeChat title candidates for an existing article: use `title suggest --json`; it emits a host-Agent AI request and does not choose or write the final title.\n- Product introductions, encyclopedia articles or entry drafts, and platform/search-directed writing: read `md2wechat skills read md2wechat references/writing/workflow.md --json` and follow it as the host Agent. Prefer this route over `advise` or `write` for these requests; skip it for formatting-only tasks.\n- Existing article or draft, user asks what to improve next: run `md2wechat advise --json`; treat it as recommendation-only and keep `inspect --json data.readiness.targets/blockers` as the publish gate.\n- Writing in a creator style or removing AI traces: use `write` or `humanize`.\n- Provider, theme, prompt, or layout uncertainty: run discovery first. Do not guess from memory or repository files.\n\nTreat `convert --draft` and `create_image_post` as different publish targets, not interchangeable variants.\n\n## Discovery First\n\nUse CLI discovery as the source of truth, but keep it scoped to the next decision. Do not run the full catalog for tasks that do not need provider, theme, prompt, or layout selection.\n\nUse `capabilities` for aggregate routing facts, resource `list` for lightweight selection fields, `show` for one full resource definition, and `render` for materialized prompt/layout output. JSON stdout is compact; use `jq` only when a human needs formatted output.\n\nRun the smallest useful discovery set:\n\n- Article formatting with no theme or modules chosen:\n ```bash\n md2wechat themes list --json\n md2wechat layout list --json\n ```\n\n- A named theme, provider, prompt, or layout module:\n ```bash\n md2wechat themes show --json\n md2wechat providers show --json\n md2wechat prompts show --kind --json\n md2wechat layout show --json\n ```\n\n- Image generation or image-preset selection:\n ```bash\n md2wechat providers list --json\n md2wechat prompts list --kind image --json\n ```\n\n- Subject-reference (image-to-image) capability before using `--subject-reference`:\n ```bash\n md2wechat providers show minimax --json\n ```\n Read `supports_subject_reference` on the provider and on each entry of `supported_models`. Only the `minimax` provider and its `image-01` model accept `--subject-reference`, and the reference must be a publicly reachable `http(s)` portrait image URL; inline data URLs and local paths are rejected. Unsupported provider/model combinations fail immediately with `CONFIG_INVALID`, so do not retry them as generation failures.\n\n- Title suggestion prompt selection:\n ```bash\n md2wechat prompts list --kind title --json\n md2wechat prompts show wechat-title-expert --kind title --json\n ```\n\n- Draft, upl","createdAt":"2026-09-25T11:51:48.730Z","updatedAt":"2026-09-25T11:51:48.730Z"},{"id":"cmugwhmav019wqu06mgrcp6oz","slug":"geekjourneyx-md2wechat-skill-md2wechat-2","name":"md2wechat","description":"Convert Markdown to WeChat Official Account HTML, inspect supported providers/themes/prompts, generate article images, create drafts, write with creator styles, prepare title suggestions, and remove AI writing traces. Also use for unpublished Zhihu, CSDN, Toutiao, or Tencent Cloud Developer Community drafts through a browser. Use for product introductions, encyclopedia articles or entry drafts, and writing tailored to platforms or search targets.","authorId":"gh:geekjourneyx","authorName":"geekjourneyx","version":"0.1.0","category":"Prompt","securityLevel":"Sandbox","downloadsCount":0,"githubStars":3670,"pricePerCall":0,"manifest":{"name":"md2wechat","tools":[],"category":"Prompt","entrypoint":{"type":"prompt"},"description":"Convert Markdown to WeChat Official Account HTML, inspect supported providers/themes/prompts, generate article images, create drafts, write with creator styles, prepare title suggestions, and remove AI writing traces. Also use for unpublished Zhihu, CSDN, Toutiao, or Tencent Cloud Developer Community drafts through a browser. Use for product introductions, encyclopedia articles or entry drafts, and writing tailored to platforms or search targets.","permissions":[],"systemPrompt":"# md2wechat\n\nUse this skill to operate the `md2wechat` CLI. Keep the skill focused on execution decisions. For full command tutorials, installation details, and FAQ-level explanations, refer users to the project docs instead of expanding this runtime protocol.\n\n## Intent Routing\n\nChoose the command family before taking any publish or generation action:\n\n- Standard article HTML, article preview, metadata inspection, or WeChat article draft: use `inspect`, `preview`, and `convert`.\n- Unpublished Zhihu, CSDN, Toutiao, or Tencent Cloud Developer Community draft: run `md2wechat skills read md2wechat references/sync/workflow.md --json` for the current CLI's embedded workflow; the CLI prepares content and the Agent operates the browser.\n- Image-first post, image note, image-text note, `newspic`, or multi-image post: use `create_image_post`, not `convert --draft`.\n- Article cover or article infographic: prefer `generate_cover` or `generate_infographic` over raw `generate_image` when a bundled preset fits.\n- Host-agent image generation request with no provider configured: use image plan mode (`--plan --json`) to get prompt intent, then hand it to the host image-generation tool if one is available outside md2wechat.\n- WeChat title candidates for an existing article: use `title suggest --json`; it emits a host-Agent AI request and does not choose or write the final title.\n- Product introductions, encyclopedia articles or entry drafts, and platform/search-directed writing: read `md2wechat skills read md2wechat references/writing/workflow.md --json` and follow it as the host Agent. Prefer this route over `advise` or `write` for these requests; skip it for formatting-only tasks.\n- Existing article or draft, user asks what to improve next: run `md2wechat advise --json`; treat it as recommendation-only and keep `inspect --json data.readiness.targets/blockers` as the publish gate.\n- Writing in a creator style or removing AI traces: use `write` or `humanize`.\n- Provider, theme, prompt, or layout uncertainty: run discovery first. Do not guess from memory or repository files.\n\nTreat `convert --draft` and `create_image_post` as different publish targets, not interchangeable variants.\n\n## Discovery First\n\nUse CLI discovery as the source of truth, but keep it scoped to the next decision. Do not run the full catalog for tasks that do not need provider, theme, prompt, or layout selection.\n\nUse `capabilities` for aggregate routing facts, resource `list` for lightweight selection fields, `show` for one full resource definition, and `render` for materialized prompt/layout output. JSON stdout is compact; use `jq` only when a human needs formatted output.\n\nRun the smallest useful discovery set:\n\n- Article formatting with no theme or modules chosen:\n ```bash\n md2wechat themes list --json\n md2wechat layout list --json\n ```\n\n- A named theme, provider, prompt, or layout module:\n ```bash\n md2wechat themes show --json\n md2wechat providers show --json\n md2wechat prompts show --kind --json\n md2wechat layout show --json\n ```\n\n- Image generation or image-preset selection:\n ```bash\n md2wechat providers list --json\n md2wechat prompts list --kind image --json\n ```\n\n- Subject-reference (image-to-image) capability before using `--subject-reference`:\n ```bash\n md2wechat providers show minimax --json\n ```\n Read `supports_subject_reference` on the provider and on each entry of `supported_models`. Only the `minimax` provider and its `image-01` model accept `--subject-reference`, and the reference must be a publicly reachable `http(s)` portrait image URL; inline data URLs and local paths are rejected. Unsupported provider/model combinations fail immediately with `CONFIG_INVALID`, so do not retry them as generation failures.\n\n- Title suggestion prompt selection:\n ```bash\n md2wechat prompts list --kind title --json\n md2wechat prompts show wechat-title-expert --kind title --json\n ```\n\n- Draft, upload, API local-readiness, or configuration troubleshooting:\n ```bash\n md2wechat doctor --json\n md2wechat config show --format json\n md2wechat config wechat-accounts --json\n ```\n `doctor` readiness is local configuration attemptability. `config wechat-accounts` is local-only and never prints WeChat secrets. Use `inspect --json` for article-specific target readiness.\n\n- Unknown CLI version, changed behavior, or capability uncertainty:\n ```bash\n md2wechat version --json\n md2wechat capabilities --json\n md2wechat skills list --json\n md2wechat skills read md2wechat --json\n ```\n\n`md2wechat skills read md2wechat --json` reads the core coding-agent SOP embedded in the current CLI binary. Use it when the local OpenClaw skill copy may be older than the executable on `PATH`; keep OpenClaw installation metadata from this platform skill as the platform-specific layer.\n\nFor simple local actions such as `preview`, `humanize`, or a user-specified command with explicit flags, do not run unrelated provider, theme, prompt, or layout discovery.\n\nInspect specific resources only when the task needs them:\n\n```bash\nmd2wechat providers show --json\nmd2wechat themes show --json\nmd2wechat prompts show --kind --json\nmd2wechat layout show --json\n```\n\nUse CLI output as the source of truth for currently available modes, providers, themes, prompts, and layout modules.\n\n## Configuration Boundaries\n\n- Assume `md2wechat` is already available on `PATH`.\n- `convert` defaults to API mode unless the user explicitly asks for `--mode ai`.\n- API-mode preview and conversion require a valid `MD2WECHAT_API_KEY`.\n- WeChat upload, article draft creation, and `create_image_post` require WeChat credentials whenever the user explicitly requests those side effects.\n- Read-only discovery, `inspect`, `preview`, and plain conversion are free of any global WeChat publishing credential requirement; API-mode preview and conversion still require a valid `MD2WECHAT_API_KEY`.\n- Named WeChat account execution requires a valid `MD2WECHAT_API_KEY`; the CLI validates it before upload, draft, or `create_image_post` effects.\n- Direct image generation requires image-provider credentials; image plan mode (`--plan --json`) only emits prompt intent for a host Agent or external tool and does not require image-provider credentials.\n- `title suggest --json` only emits a title-generation prompt request for the host Agent or external model. It does not call a model, upload, create drafts, or write back to Markdown.\n- For stronger factual title hooks, pass --hook-level 2 or 3; do not treat generated titles as confirmed publishing intent.\n- `doctor --json` is local-only: it checks local readiness and does not perform live authentication, upload images, or create drafts.\n- Use `config show --format json` when the user asks what configuration is currently effective.\n- Use `config wechat-accounts --json` when the user asks which local WeChat accounts are configured.\n\n## Article Workflow\n\nPrefer a confirm-first workflow for article work:\n\n1. `md2wechat inspect --json`\n2. `md2wechat preview `\n3. `md2wechat convert ...`\n4. Add `--upload`, `--draft`, `--cover`, or `--cover-media-id` only when the user explicitly asks for upload or draft creation.\n\n`inspect` is the source-of-truth command for structured metadata, checks, readiness targets, and blockers. In `--json` output, read `data.readiness.targets` and `data.readiness.blockers` before deciding whether `convert`, `upload`, or `draft` is blocked. If the requested target is blocked, stop and report the matching blockers; do not continue by guessing from legacy booleans or `checks` alone. Do not invent `data.agent_readiness`, `data.target_readiness`, `ArticleState`, state files, or a second readiness/state object. `preview` writes only byte-identical final API HTML from a successful converter result; with `--json`, inspect diagnostics are returned in `data.inspect` and are never wrapped into that file. It does not upload images, create drafts, or write back to Markdown. `convert` performs conversion and only the explicitly requested upload/draft effects. `convert --preview` is the convert-path preview flag and is not the same as the standalone `preview` command. On `PREVIEW_ACTION_REQUIRED` or `PREVIEW_FAILED`, this invocation does not create or overwrite preview HTML. With `--json`, `PREVIEW_ACTION_REQUIRED` returns an empty `data.output_file`. Any pre-existing explicit output path is stale and must not be treated as this invocation's result; use the returned prompt for host-Agent work or report the failure.\nWhen the intended execution path is `convert --mode ai --custom-prompt ...`, run `inspect` with the same `--mode ai --custom-prompt ...` before trusting readiness.\n\n## Formatting Protocol\n\nWhen the user asks to format an article and has not chosen a theme or modules:\n\n1. Read the article and optional Brand Profile.\n2. Use discovery output as facts.\n3. Choose a compatible theme and a small set of modules from the article's content goal.\n4. Keep the source Markdown read-only.\n5. Create a temporary formatted Markdown artifact, for example `/tmp/md2wechat-format//article.formatted.md`.\n6. Insert only layout modules whose required fields can be filled correctly.\n7. Run `md2wechat layout validate --file --json`.\n8. Pass the formatted Markdown artifact to `convert`.\n\nSaving generated Markdown next to the source file requires explicit user confirmation and must not overwrite the source.\n\n## Theme Selection\n\n- Read `type` and `selectable` from `themes list --json`.\n- API mode can use only `type: api` and `selectable: true` themes.\n- AI mode can use only `type: ai` and `selectable: true` themes.\n- Do not use collection descriptors such as non-selectable theme groups as concrete themes.\n- If Brand Profile names a theme, verify it through CLI discovery before using it.\n- If a requested theme is invalid or mode-incompatible, stop that path and choose a valid theme or ask the user.\n\n## Layout Modules\n\nAdvanced layout modules render only in API mode. AI mode (`--mode ai`) does not parse `:::module` syntax, so advanced layout cards will not render there.\n\nUse this decision frame:\n\n- `attention`: help readers decide whether the article is worth reading.\n- `readability`: make mobile reading easier.\n- `memorability`: make one judgment, quote, metric, or brand anchor stick.\n- `conversion`: help readers save, follow, inquire, share, or buy.\n\nUse CLI discovery as the source of truth for layout syntax instead of memorizing or guessing `body_format` values:\n\n- Inspect the opener, body schema, canonical executable example, and structurally distinct variants with `layout show --json`. Reuse the canonical witness.\n- Use `layout render` for structured fields and `--body-file` (or `--body-file -` for stdin) for complex bodies, then validate the generated Markdown.\n- Default discovery returns recommended modules. Use `layout list --lifecycle compatibility --json` only for old-content migration. Local validation proves syntax acceptance only; production support is a release-conformance fact.\n- `gallery` is recommended. For `expand`, pass header fields, a standalone `---`, and Markdown body through `--body-file`. `cover-reveal` and `expand` default to complete static output; use `first-layer` only when the user explicitly requests an interaction candidate, and verify the target API before relying on it.\n\nDefault module discipline:\n\n- Do not pile on modules.\n- Use at most one hero, one verdict, and one cta unless the user explicitly asks for more.\n- Skip modules when the article does not provide enough content to fill them honestly.\n\n## API And AI Mode\n\n- API mode is the default and is required for advanced layout modules.\n- AI mode is a lighter path and does not render advanced layout modules.\n- Do not silently switch from API mode to AI mode after an API failure. That changes the output capability.\n- Use AI mode only when the user asks for it or accepts losing advanced layout rendering.\n- If an AI-mode conversion completes, it is acceptable to briefly mention that API mode supports advanced layout modules and stronger visual structure.\n\n## Brand Profile\n\nBrand Profile lives at `~/.config/md2wechat/brand.md`.\n\n- It is free-form Markdown, not YAML and not a fixed schema.\n- The CLI does not parse it.\n- Read it as context for voice, theme preferences, module preferences, CTA preferences, and forbidden expressions.\n- Treat quantity preferences as soft constraints.\n- Verify any named theme or module through CLI discovery.\n- If Brand Profile does not exist, do not block the task. You may mention once that system defaults will be used.\n- Create or edit Brand Profile only when the user explicitly asks.\n\n## Publishing Side Effects\n\nDo not create drafts, upload images, publish, or call remote image generation unless the user asks for that action.\n\nBefore every explicit WeChat side effect—image upload, article draft creation, or `create_image_post`—require configured WeChat credentials and use the target-matched readiness/preflight path. Discovery and inspection remain non-publishing paths; preview and plain conversion are free of any global WeChat publishing credential requirement, while API mode still requires a valid `MD2WECHAT_API_KEY`.\n\nBefore WeChat article draft creation through `convert`:\n\n- Use `inspect --json` and check `data.readiness.targets.draft`; when blocked, read matching `data.readiness.blockers`.\n- Draft creation requires a cover via `--cover` or `--cover-media-id`.\n- Do not assume a WeChat URL or `mmbiz.qpic.cn` URL can be reused as `thumb_media_id`.\n- If draft creation returns `45004`, check digest, summary, and description before assuming the body is too long.\n\nIn the WeChat `convert` flow, Markdown images are uploaded or replaced only during `--upload` or `--draft`, not during plain conversion or preview.\n\n## Failure Handling\n\n- Missing or invalid config: run `doctor --json` and `config show --format json`; report `data.overall` plus the blocking `data.readiness.*` item.\n- Invalid layout syntax: run `layout validate`, inspect the failing module with `layout show`, fix the generated artifact, then validate again.\n- Unknown layout modules warn for forward compatibility; verify typos against `layout list --json`.\n- Theme rejection: check `type` and `selectable`, then choose a compatible theme or ask the user.\n- AI request or style-writing flows may return a prompt/request rather than final prose or HTML unless the external model step is completed.","schemaVersion":1},"repoUrl":"https://github.com/geekjourneyx/md2wechat-skill/tree/main/platforms/openclaw/md2wechat","tags":["agent-cli","ai-agent","ai-writing","claude-code","claude-skills","cli","go","markdown","markdown-converter","markdown-formatter","markdown-to-html","markdown-to-wechat"],"stats":{"installVelocity7d":0,"retentionRate":0,"executions":0,"rating":null},"origin":"github","source":{"repo":"md2wechat-skill","audit":{"files":["go.mod","go.sum","package.json"],"binaries":[],"findings":[{"kind":"dependency","rule":"DP-02","message":"`postinstall` script runs on every install.","surface":"package.json","evidence":"postinstall: node scripts/install.js","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"github.com/disintegration/imaging@v1.6.2 has a known vulnerability: Crash when processing crafted TIFF files.","surface":"go.mod, go.sum, package.json","evidence":"GHSA-q7pp-wcgr-pffx · Go:github.com/disintegration/imaging@v1.6.2","severity":"low"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8 has a known vulnerability: Go Images vulnerable to an out-of-memory error via a crafted TIFF file.","surface":"go.mod, go.sum, package.json","evidence":"GHSA-44p7-9xx4-hf2g · Go:golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8","severity":"medium"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8 has a known vulnerability: Panic when parsing invalid palette-color images in golang.org/x/image.","surface":"go.mod, go.sum, package.json","evidence":"GHSA-9phm-fm57-rhg8 · Go:golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8 has a known vulnerability: Golang TIFF decoder vulnerable to excessive CPU consumption.","surface":"go.mod, go.sum, package.json","evidence":"GHSA-j3p8-6mrq-6g7h · Go:golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8","severity":"medium"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8 has a known vulnerability: golang.org/x/image/tiff has excessive resource consumption in PackBits decompression.","surface":"go.mod, go.sum, package.json","evidence":"GHSA-q675-qj96-32m9 · Go:golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8 has a known vulnerability: Uncontrolled Resource Consumption in golang.org/x/image.","surface":"go.mod, go.sum, package.json","evidence":"GHSA-qgc7-mgm3-q253 · Go:golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8","severity":"medium"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8 has a known vulnerability: Golang TIFF decoder does not place a limit on the size of compressed tile data.","surface":"go.mod, go.sum, package.json","evidence":"GHSA-x92r-3vfx-4cv3 · Go:golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8","severity":"medium"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8 has a known vulnerability: Denial of service via crafted TIFF image in golang.org/x/image/tiff.","surface":"go.mod, go.sum, package.json","evidence":"GO-2023-1572 · Go:golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8 has a known vulnerability: Excessive resource consumption in golang.org/x/image/tiff.","surface":"go.mod, go.sum, package.json","evidence":"GO-2023-1989 · Go:golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8 has a known vulnerability: Excessive CPU consumption when decoding 0-height images in golang.org/x/image/tiff.","surface":"go.mod, go.sum, package.json","evidence":"GO-2023-1990 · Go:golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2024-2937 · Go:golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-4815 · Go:golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-4961 · Go:golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-4962 · Go:golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-5031 · Go:golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-5032 · Go:golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-5061 · Go:golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-5062 · Go:golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-5066 · Go:golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-6222 · Go:golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/net@v0.38.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GHSA-5cv4-jp36-h3mw · Go:golang.org/x/net@v0.38.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/net@v0.38.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-4440 · Go:golang.org/x/net@v0.38.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/net@v0.38.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-4441 · Go:golang.org/x/net@v0.38.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/net@v0.38.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-4918 · Go:golang.org/x/net@v0.38.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/net@v0.38.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-5025 · Go:golang.org/x/net@v0.38.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/net@v0.38.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-5026 · Go:golang.org/x/net@v0.38.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/net@v0.38.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-5027 · Go:golang.org/x/net@v0.38.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/net@v0.38.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-5028 · Go:golang.org/x/net@v0.38.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/net@v0.38.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-5029 · Go:golang.org/x/net@v0.38.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/net@v0.38.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-5030 · Go:golang.org/x/net@v0.38.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/net@v0.38.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-5942 · Go:golang.org/x/net@v0.38.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"github.com/sirupsen/logrus@v1.9.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GHSA-4f99-4q7p-p3gh · Go:github.com/sirupsen/logrus@v1.9.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"github.com/sirupsen/logrus@v1.9.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2025-4188 · Go:github.com/sirupsen/logrus@v1.9.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GHSA-45gg-vh54-h5m9 · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GHSA-5cgq-3rg8-m6cv · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GHSA-78mq-xcr3-xm33 · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GHSA-89gr-r52h-f8rx · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GHSA-9m57-25v3-79x9 · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GHSA-f5wc-c3c7-36mc · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GHSA-f6x5-jh6r-wrfv · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GHSA-j5w8-q4qc-rx2x · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GHSA-jppx-rxg9-jmrx · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GHSA-q4h4-gmj2-qvw2 · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GHSA-qpw4-5x99-6vjp · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GHSA-rm3j-f69w-wqmq · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GHSA-vgwf-h737-ff37 · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GHSA-w879-237q-wc7r · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GHSA-x527-x647-q7gg · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2025-4116 · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2025-4134 · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2025-4135 · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-5005 · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-5006 · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-5013 · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-5014 · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-5015 · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-5016 · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-5017 · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-5018 · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-5019 · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-5020 · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-5021 · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-5023 · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-5033 · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-5932 · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-6303 · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-6354 · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/crypto@v0.36.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-6355 · Go:golang.org/x/crypto@v0.36.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"golang.org/x/text@v0.23.0 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-5970 · Go:golang.org/x/text@v0.23.0","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"google.golang.org/grpc@v1.66.2 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GHSA-2v4p-qf9q-27wj · Go:google.golang.org/grpc@v1.66.2","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"google.golang.org/grpc@v1.66.2 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GHSA-hrxh-6v49-42gf · Go:google.golang.org/grpc@v1.66.2","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"google.golang.org/grpc@v1.66.2 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GHSA-p77j-4mvh-x3m3 · Go:google.golang.org/grpc@v1.66.2","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"google.golang.org/grpc@v1.66.2 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GHSA-qc2q-p7wx-3px3 · Go:google.golang.org/grpc@v1.66.2","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"google.golang.org/grpc@v1.66.2 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GHSA-vp52-pcj8-j9qc · Go:google.golang.org/grpc@v1.66.2","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"google.golang.org/grpc@v1.66.2 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-4762 · Go:google.golang.org/grpc@v1.66.2","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"google.golang.org/grpc@v1.66.2 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-6061 · Go:google.golang.org/grpc@v1.66.2","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"google.golang.org/grpc@v1.66.2 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-6348 · Go:google.golang.org/grpc@v1.66.2","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"google.golang.org/grpc@v1.66.2 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-6441 · Go:google.golang.org/grpc@v1.66.2","severity":"high"},{"kind":"dependency","rule":"DP-01","message":"google.golang.org/grpc@v1.66.2 has a known vulnerability.","surface":"go.mod, go.sum, package.json","evidence":"GO-2026-6443 · Go:google.golang.org/grpc@v1.66.2","severity":"high"}],"packages":36,"auditedAt":"2026-09-25T11:51:48.601Z","lockfiles":["go.sum"]},"forks":413,"owner":"geekjourneyx","stars":3670,"topics":["agent-cli","ai-agent","ai-writing","claude-code","claude-skills","cli","go","markdown","markdown-converter","markdown-formatter","markdown-to-html","markdown-to-wechat","mcp-server","md2wechat","wechat","wechat-article","wechat-mp","wechat-official-account","wechat-public-account","weixin"],"license":null,"fullName":"geekjourneyx/md2wechat-skill","homepage":"https://md2wechat.cn","language":"Go","pushedAt":"2026-09-24T08:59:11Z","avatarUrl":"https://avatars.githubusercontent.com/u/24422856?v=4","crawledAt":"2026-09-25T11:51:44.524Z","openIssues":5,"manifestFile":"SKILL.md","manifestPath":"platforms/openclaw/md2wechat/SKILL.md","defaultBranch":"main"},"readme":"# md2wechat\n\nUse this skill to operate the `md2wechat` CLI. Keep the skill focused on execution decisions. For full command tutorials, installation details, and FAQ-level explanations, refer users to the project docs instead of expanding this runtime protocol.\n\n## Intent Routing\n\nChoose the command family before taking any publish or generation action:\n\n- Standard article HTML, article preview, metadata inspection, or WeChat article draft: use `inspect`, `preview`, and `convert`.\n- Unpublished Zhihu, CSDN, Toutiao, or Tencent Cloud Developer Community draft: run `md2wechat skills read md2wechat references/sync/workflow.md --json` for the current CLI's embedded workflow; the CLI prepares content and the Agent operates the browser.\n- Image-first post, image note, image-text note, `newspic`, or multi-image post: use `create_image_post`, not `convert --draft`.\n- Article cover or article infographic: prefer `generate_cover` or `generate_infographic` over raw `generate_image` when a bundled preset fits.\n- Host-agent image generation request with no provider configured: use image plan mode (`--plan --json`) to get prompt intent, then hand it to the host image-generation tool if one is available outside md2wechat.\n- WeChat title candidates for an existing article: use `title suggest --json`; it emits a host-Agent AI request and does not choose or write the final title.\n- Product introductions, encyclopedia articles or entry drafts, and platform/search-directed writing: read `md2wechat skills read md2wechat references/writing/workflow.md --json` and follow it as the host Agent. Prefer this route over `advise` or `write` for these requests; skip it for formatting-only tasks.\n- Existing article or draft, user asks what to improve next: run `md2wechat advise --json`; treat it as recommendation-only and keep `inspect --json data.readiness.targets/blockers` as the publish gate.\n- Writing in a creator style or removing AI traces: use `write` or `humanize`.\n- Provider, theme, prompt, or layout uncertainty: run discovery first. Do not guess from memory or repository files.\n\nTreat `convert --draft` and `create_image_post` as different publish targets, not interchangeable variants.\n\n## Discovery First\n\nUse CLI discovery as the source of truth, but keep it scoped to the next decision. Do not run the full catalog for tasks that do not need provider, theme, prompt, or layout selection.\n\nUse `capabilities` for aggregate routing facts, resource `list` for lightweight selection fields, `show` for one full resource definition, and `render` for materialized prompt/layout output. JSON stdout is compact; use `jq` only when a human needs formatted output.\n\nRun the smallest useful discovery set:\n\n- Article formatting with no theme or modules chosen:\n ```bash\n md2wechat themes list --json\n md2wechat layout list --json\n ```\n\n- A named theme, provider, prompt, or layout module:\n ```bash\n md2wechat themes show --json\n md2wechat providers show --json\n md2wechat prompts show --kind --json\n md2wechat layout show --json\n ```\n\n- Image generation or image-preset selection:\n ```bash\n md2wechat providers list --json\n md2wechat prompts list --kind image --json\n ```\n\n- Subject-reference (image-to-image) capability before using `--subject-reference`:\n ```bash\n md2wechat providers show minimax --json\n ```\n Read `supports_subject_reference` on the provider and on each entry of `supported_models`. Only the `minimax` provider and its `image-01` model accept `--subject-reference`, and the reference must be a publicly reachable `http(s)` portrait image URL; inline data URLs and local paths are rejected. Unsupported provider/model combinations fail immediately with `CONFIG_INVALID`, so do not retry them as generation failures.\n\n- Title suggestion prompt selection:\n ```bash\n md2wechat prompts list --kind title --json\n md2wechat prompts show wechat-title-expert --kind title --json\n ```\n\n- Draft, upl","createdAt":"2026-09-25T11:51:48.775Z","updatedAt":"2026-09-25T11:51:48.775Z"}],"total":2,"limit":24,"offset":0}