Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add jianshuo/claude-skills --skill wjs-syndicating-articlesgit clone --depth 1 https://github.com/jianshuo/claude-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/jianshuo/claude-skills/wjs-syndicating-articles)<a href="https://agentmods.dev/skills/jianshuo/claude-skills/wjs-syndicating-articles"><img src="https://agentmods.dev/badge/skills/jianshuo/claude-skills/wjs-syndicating-articles/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/jianshuo/claude-skills/wjs-syndicating-articles"><img src="https://agentmods.dev/badge/skills/jianshuo/claude-skills/wjs-syndicating-articles.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 70 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 77 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- medium Agent Snooping · line 27 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00118 | $0.01456 |
| Opus 5 | $0.00059 | $0.00728 |
| Sonnet 5 | $0.00024 | $0.00291 |
| Haiku 4.5 | $0.00012 | $0.00146 |
Grade A, and why
wjs-syndicating-articles scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 83 lines — stays where its author put it; the contents beside it link to each section on GitHub.
wjs-syndicating-articles
每天把最新一篇还没分发过的公众号文章，扇出（syndicate）到各社交平台。一套文案走天下，有 API 的真发，没 API 的备好待发件箱让你手动粘。
Core Principles
- 稳定第一：每个平台是独立步骤，一个失败绝不影响其它。
- 幂等去重：
state/history.jsonl按(slug, platform)记录；重复跑只补发没成功的，永不重复发。 - 凭证降级：API 平台缺/过期凭证 → 自动转 outbox（手动），不报错。
- 署名 / CTA 用「王建硕」（用户全局偏好），不写营销腔、不堆 hashtag/@/emoji（除非原文有）。
Inputs
/wjs-syndicating-articles # 选最新未分发文章，走完整流程（默认/定时用）
/wjs-syndicating-articles <article-folder># 显式指定文章
/wjs-syndicating-articles --open # 交互模式：打开手动平台 web 页 + 文案进剪贴板
/wjs-syndicating-articles --dry-run # 只草拟，不发、不写 history
/wjs-syndicating-articles --mark <slug> <platform> # 手动标记某平台已发
SKILL_DIR = ~/.claude/skills/wjs-syndicating-articles
Workflow (default / scheduled run)
Step 0: --mark short-circuit
若调用是 --mark <slug> <platform>：bash $SKILL_DIR/scripts/history.sh record <slug> <platform> posted 然后告诉用户已标记，结束。
Step 1: 选文章
bash $SKILL_DIR/scripts/pick-next-article.sh
- 显式指定了
<article-folder>则跳过此脚本，直接用它。 - 输出为空 → 最近文章都分发完了，今天 rest day，结束。
- 记
FOLDER，SLUG=$(basename "$FOLDER")。
Step 2: 抽一套核心文案（你来做，不是脚本）
读 $FOLDER/article.md 和 $FOLDER/meta.json。抽出一段最 quotable 的核心句/小段，≤120 字（保证塞进 X 的 280 字符；中文每字算 2），保留王建硕语气。再加一行软 CTA + 文章链接（公众号链接，没有就用 meta.json 里信息+ article_url_base）。
把最终文案写进 $SKILL_DIR/outbox/<date>-<SLUG>/post.txt（先 mkdir -p）。<date>=$(date +%F)。
--dry-run 时：打印 post.txt 内容 + 下面每个平台「将发什么」，不继续 Step 3+，结束。
Step 3: 扇出（一个确定性脚本搞定，LLM 不碰 key）
bash $SKILL_DIR/scripts/syndicate.sh "$FOLDER" "$POST_TXT"
syndicate.sh 内部：slug 一律取 basename "$FOLDER"；API 平台（X/Bluesky/Threads/LinkedIn）逐个 try/catch 真发，X 会先查 tweeting skill 的 history 防双发，缺凭证的自动降级记 queued；手动平台（Facebook/小红书/即刻/知乎）调 build-outbox.sh 备好 outbox/<slug>/ 并记 queued。不要自己手写平台循环或拼 slug —— 全交给脚本，避免 key 漂移。--dry-run 时改跑 syndicate.sh "$FOLDER" "$POST_TXT" --dry-run（不发、不写 history）。脚本 stdout 的每行 <platform>: ... 和末尾 outbox=... 就是 Step 5 汇总的数据来源。
What ships with it
23 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- .gitignore 51 B
- config.json 708 B
- run-scheduled.sh 1.5 KB runs code
- scripts/build-outbox.sh 2.0 KB runs code
- scripts/history.sh 1.4 KB runs code
- scripts/lib.sh 886 B runs code
- scripts/pick-next-article.sh 630 B runs code
- scripts/post-bluesky.sh 1.5 KB runs code
- scripts/post-linkedin.sh 1.2 KB runs code
- scripts/post-threads.sh 1.3 KB runs code
- scripts/post-x.sh 815 B runs code
- scripts/syndicate.sh 2.6 KB runs code
- scripts/test/assert.sh 955 B runs code
- scripts/test/test_build_outbox.sh 1.7 KB runs code
- scripts/test/test_e2e_dryrun.sh 1.9 KB runs code
- scripts/test/test_history.sh 1.5 KB runs code
- scripts/test/test_pick.sh 1.0 KB runs code
- scripts/test/test_post_bluesky.sh 1.1 KB runs code
- scripts/test/test_post_linkedin.sh 824 B runs code
- scripts/test/test_post_threads.sh 735 B runs code
- scripts/test/test_post_x.sh 581 B runs code
- scripts/test/test_syndicate.sh 2.7 KB runs code
- secrets.json.example 263 B
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 83 lines · 118 tokens per session scan A 8a606f10bc40
wjs-syndicating-articles is a skill published in the GitHub repository jianshuo/claude-skills (129 stars, last pushed 23d ago), licensed MIT. It adds 118 tokens to every session and 1,456 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
exploratory-data-analysis
Perform bounded, local exploratory analysis of explicitly supported scientific files. Use for redacted CSV/TSV/JSON profiles; optional NumPy, HDF5, FASTA/FASTQ, and basic image metadata inspection; missingness/leakage audits; outlier and transformation sensitivity; and rigorous EDA report scaffolds. Other domain…
google-ads-audit
Google Ads account audit and business context setup. Use for account-health audits and business-context setup. Trigger on "audit my ads", "ads audit", "set up my ads", "onboard", "account overview", "how's my account", "ads health check", "what should I fix in my ads", or when the user is new to NotFair and hasn't run…
data-charts-tako
Search and visualize the world's data - get charts, insights, and embeddable knowledge cards for finance, economics, demographics, sports, and more.
webhook-management
Configure and validate CCAM webhook targets across supported chat, incident, automation, and generic providers. Use when listing provider requirements, creating or updating a target, scoping it to alert rules, sending a test notification, reviewing delivery history, or deleting a target.
gesellschaftsrechtliche-satzungen-agb
Für Gesellschaftsrechtliche Satzungen AGB Abgrenzung: ordnet Norm, Beweislast und Gegenargument; Ergebnis: Prüfprodukt mit Risiko und nächstem Schritt. Fachgebiet: AGB-Recht-Prüfer. Route: gesellschaftsrechtliche-satzungen-agb.
master-yinguang
A reference-based assistant for questions about Yinguang and Pure Land Buddhism, a Buddhist tradition focused on faith, ethical living, and practice connected with rebirth in the Pure Land. It can answer in Yinguang’s historical teaching style.