ReactUse is a TypeScript library of reusable React Hooks for browser APIs, state, sensors, animations, and DOM interactions. React developers use it when building React applications that need these common behaviors. The catalogue skills and commands help coding agents discover or work with ReactUse hooks.
Borrowing it
Nothing to install: this file belongs to childrentime/reactuse. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/childrentime/reactuse/main/.claude/skills/publish-medium/SKILL.mdgit clone --depth 1 https://github.com/childrentime/reactuseWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/childrentime/reactuse/publish-medium)<a href="https://agentmods.dev/skills/childrentime/reactuse/publish-medium"><img src="https://agentmods.dev/badge/skills/childrentime/reactuse/publish-medium/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/childrentime/reactuse/publish-medium"><img src="https://agentmods.dev/badge/skills/childrentime/reactuse/publish-medium.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high YARA Match · line 4 YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).Fix: Remove offensive tool references and exploit code. Legitimate agent skills should not contain penetration testing tools, exploit frameworks, or reconnaissance utilities.
- high Prompt Injection · line 77 Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00137 | $0.03763 |
| Opus 5.5 | $0.00055 | $0.01505 |
| Sonnet 5.5 | $0.00027 | $0.00753 |
| Haiku 4.5 | $0.00014 | $0.00376 |
Grade A, and why
publish-medium scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 233 lines — stays where its author put it; the contents beside it link to each section on GitHub.
publish-medium — 跨发到 Medium（opencli 浏览器自动化）
reactuse.com 的博客在 Medium 上做镜像分发，扩大英文触达。Medium 是真实增量流量（推荐流 + 订阅者收件箱）。
⚠️ 路径：opencli 浏览器自动化（已取代旧的 bridge + 扩展方案）
历史：2026-06 之前用的是本地 Bridge 服务 + Chrome 扩展（
medium-pushskill，靠 SSE 推 markdown 到扩展、扩展转 HTML 再模拟粘贴）。现在统一走opencli，和publish-hashnode一致，不再需要那套 bridge。旧 skill 已删除。
核心难点：Medium 的编辑器（.js-postField，contenteditable + 自有数据模型）不解析 markdown。直接 fill markdown 文本只会得到一坨纯文本。正确做法和那个旧扩展一样——把 markdown 转成 HTML，然后模拟一次 paste 事件（带 text/html 的 DataTransfer），Medium 的粘贴处理器会把 HTML 正确吃进它的模型。标题则用 execCommand("insertText") 灌（Medium 模型只认"输入"路径，直接写 DOM textContent 不进模型）。
触发场景
- 用户明说："发到 medium" / "publish to medium" / "把这篇 cross-post 到 medium"
- 刚写完一篇博客并说"发出去" / "同步发布" / "推平台"——默认包括 Medium
- 多平台分发流程的一步（dev.to + Medium + Hashnode + 掘金）
⚠️ 不要触发：用户只让发别的平台（只发 Hashnode / 掘金 / dev.to）时，不要顺手也发 Medium。
⚠️ 顺序：先推 GitHub，再跨发
英文跨发（Medium / Hashnode / dev.to）的 canonical 都指回 reactuse.com/blog/<slug>/。必须先把博客 commit + push 到 GitHub（触发 Netlify 部署），让原文链接真的存在，再发跨平台版本——否则 canonical 指向一个 404。掘金是中文翻译、独立站，不受此约束。
注：Medium 原生编辑器没有 canonical 字段（只有 Import 流程才有）。所以 Medium 这篇本身不会把权重让回 reactuse.com——它纯粹是触达渠道。这是已知取舍，不用纠结；旧的 bridge 方案同样没设 canonical。
前置检查
opencli --version # 需要 ≥ 1.7.22
opencli doctor # 必须看到 Connectivity: connected
command -v pandoc # 正文 markdown→HTML 靠 pandoc；没有就 brew install pandoc
如果 Connectivity: failed：让用户把 Chrome 切到前台、点一下 opencli 扩展图标唤醒 service worker，再 opencli doctor。
工作流程
步骤 1：确认目标文章 + 元数据
ls packages/website-astro/src/content/blog/ | tail -3
从 blog-external/post-N-<slug>/medium.md 拿正文（已剥掉 frontmatter 和 <!-- truncate -->，含 H1 标题）。从源文件 frontmatter 拿 title。
步骤 2：打开 Medium 新文章页
opencli browser default open "https://medium.com/new-story"
opencli browser default get title # 应是 "New story – Medium"（说明已登录）
如果跳到登录页：让用户先在该 Chrome 里登录 Medium，再重来。
步骤 3：正文 markdown → HTML（pandoc）+ ⚠️ 代码块空行适配
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 233 lines · 137 tokens per session scan A 6fb60db6d3d8
publish-medium is a skill published in the GitHub repository childrentime/reactuse (1,068 stars, last pushed 8d ago), licensed Unlicense. It adds 137 tokens to every session and 3,763 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
publish-medium compared with skills from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| publish-mediumchildrentime/reactuse | Skill | 1.1k | 8d ago | Unlicense | A | 137 | Claude Code |
| reactusesiberiacancode/agent-skills | Skill | 23 | 27d ago | MIT | A | 50 | Claude Code, Codex |
| next-cache-components-adoptionvercel/next.js | Skill | 143k | today | MIT | A | 95 | Claude Code |
| next-partial-prefetching-adoptionvercel/next.js | Skill | 143k | today | MIT | A | 103 | Claude Code |
| next-cache-components-optimizervercel/next.js | Skill | 143k | today | MIT | A | 123 | Claude Code |
| next-bundle-optimizervercel/next.js | Skill | 143k | today | MIT | A | 38 | Claude Code |
| next-dev-loopvercel/next.js | Skill | 143k | today | MIT | A | 68 | Claude Code |