Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add 413162826/kevinsu-skills --skill wechat-image-apigit clone --depth 1 https://github.com/413162826/kevinsu-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/413162826/kevinsu-skills/wechat-image-api)<a href="https://agentmods.dev/skills/413162826/kevinsu-skills/wechat-image-api"><img src="https://agentmods.dev/badge/skills/413162826/kevinsu-skills/wechat-image-api/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/413162826/kevinsu-skills/wechat-image-api"><img src="https://agentmods.dev/badge/skills/413162826/kevinsu-skills/wechat-image-api.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00097 | $0.00988 |
| Opus 5 | $0.00048 | $0.00494 |
| Sonnet 5 | $0.00019 | $0.00198 |
| Haiku 4.5 | $0.00010 | $0.00099 |
Grade A, and why
wechat-image-api scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
微信公众号贴图 API
只使用 api.weixin.qq.com 官方接口创建并验收图片消息草稿。不启动浏览器，不调用发布、群发或删除接口，也不提供 RPA 兜底。
环境
要求 Windows 与 PowerShell 7.2+。AppSecret 使用当前 Windows 用户的 DPAPI 加密，默认保存到 $env:CODEX_HOME\secrets；未设置 CODEX_HOME 时使用 $env:USERPROFILE\.codex\secrets。网络请求在 PowerShell 进程内完成，不把 access token 传给外部命令。
输入与离线校验
执行前完整阅读 references/package-contract.md。素材目录必须包含 image-post.json 和 1–20 张图片；account 必须明确填写，留言字段不得缺省。
先定位 Skill，再离线校验：
$codexHome = if ($env:CODEX_HOME) { $env:CODEX_HOME } else { Join-Path $env:USERPROFILE '.codex' }
$skill = Join-Path $codexHome 'skills\wechat-image-api'
& (Join-Path $skill 'scripts\Test-WeChatImagePackage.ps1') -InputFolder 'D:\贴图素材目录'
需要完整示例时，在一个尚未包含示例文件的新目录中生成并校验：
& (Join-Path $skill 'scripts\New-WeChatImagePackageExample.ps1') -OutputFolder 'D:\贴图示例'
首次配置
两个微信 API Skill 可共用同一份 DPAPI 凭据。凭据不存在时，不让用户在聊天中粘贴 AppSecret；运行本机交互式配置：
& (Join-Path $skill 'scripts\Set-WeChatOfficialAccountCredential.ps1')
& (Join-Path $skill 'scripts\Test-WeChatOfficialAccountApi.ps1')
第二条命令验证 AppID、AppSecret、草稿权限和 IP 白名单。素材包 account 必须与配置时保存的公众号名称严格一致。
如果微信返回 40164 invalid ip，立即停止并把错误中的公网出口 IP 告诉用户，提醒其进入“设置与开发 → 开发接口管理 → IP 白名单”添加该 IP。用户确认后只重试同一官方 API；禁止改走浏览器、RPA、Cookie Profile 或其他发布通道。
创建并验收草稿
只有用户明确要求写入草稿后才运行：
& (Join-Path $skill 'scripts\Publish-WeChatImageDraft.ps1') -InputFolder 'D:\贴图素材目录'
脚本逐张上传图片到 material/add_material，再用 draft/add 创建 newspic 草稿；第一张由微信作为封面。最后用 draft/get 回读并核对账号、标题、正文、图片顺序、留言设置和 media_id。
幂等与异常边界
- 每个素材目录使用独占锁，同一目录不能并发执行。
- 检查点只在确认收到
media_id后推进；已记录草稿 ID 时，重复执行只回读验收，不重复创建。 - 如果网络或进程中断在图片上传或
draft/add提交阶段，结果可能不确定。后续执行必须停止，禁止自动重试；先人工核对素材库或草稿箱，再使用新目录继续。 - 素材指纹变化但存在旧检查点时停止，不静默清空状态。
- 状态与回执使用同目录临时文件原子替换，避免留下半截 JSON。
- 只有
draft/get回读全部字段通过，才报告“草稿创建并验收通过”；不得报告“已发表”。 - 回执写入
wechat-image-api-receipt.json。任一官方 API 失败均原地报告，本 Skill 没有浏览器/RPA 兜底。
What ships with it
11 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- agents/openai.yaml 273 B
- assets/image-post.json 257 B
- assets/images/post-01.png.base64 93 B
- references/package-contract.md 1.7 KB
- scripts/New-WeChatImagePackageExample.ps1 1.1 KB runs code
- scripts/Publish-WeChatImageDraft.ps1 9.8 KB runs code
- scripts/Set-WeChatOfficialAccountCredential.ps1 1.3 KB runs code
- scripts/Test-WeChatImageApiOffline.ps1 4.9 KB runs code
- scripts/Test-WeChatImagePackage.ps1 4.4 KB runs code
- scripts/Test-WeChatOfficialAccountApi.ps1 1.1 KB runs code
- scripts/WeChatOfficialApi.psm1 18 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 64 lines · 97 tokens per session scan A 6921d3a70b4d
wechat-image-api is a skill published in the GitHub repository 413162826/kevinsu-skills (2 stars, last pushed 6d ago), licensed MIT. It adds 97 tokens to every session and 988 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
skin-creator
Create and apply a two-asset LobsterAI visual skin from the user's style description. Use only when the AI Skin Designer kit supplies the structured skinpack workflow marker; do not use for ordinary theme or image requests.
canvas-design
Create beautiful visual art in .png and .pdf documents using design philosophy. You should use this skill when the user asks to create a poster, piece of art, design, or other static piece. Create original visual designs, never copying existing artists' work to avoid copyright violations.
shogun-screenshot
A screenshot tool for getting images from a computer or web page and then cropping, resizing, or masking sensitive information. Playwright is a browser-automation tool used here to capture web pages.
cli-anything-photoshop
A command-line tool that controls Adobe Photoshop through Windows automation. It can work with Photoshop documents, layers, selections, text, image adjustments, and exports.
canvas-design
Create beautiful visual art in .png and .pdf documents using design philosophy. You should use this skill when the user asks to create a poster, piece of art, design, or other static piece. Create original visual designs, never copying existing artists' work to avoid copyright violations.
adobe-automation
Automate Adobe tasks via Rube MCP (Composio). Always search tools first for current schemas.