wjs-voicedrop

wjs-voicedrop is a skill for Claude Code, Codex from jianshuo/claude-skills. It costs 164 tokens per session (1,943 once invoked), scanned A, original, MIT.

A connector that logs the coding agent into VoiceDrop, an online service for writing, reading, publishing, and managing articles and books.

In plain words
What is it for?
Use it to connect to VoiceDrop, sign in with a phone-pairing code, and pass the resulting access token to the client.
Why use it?
It removes the need to manually configure the VoiceDrop connection or handle its login token. After pairing a phone, the agent can use VoiceDrop's available tools.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one. Also seen: positional $N argument.

Good fit Use it to connect to VoiceDrop, sign in with a phone-pairing code, and pass the resulting access token to the client.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/jianshuo/claude-skills/wjs-voicedrop
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add jianshuo/claude-skills --skill wjs-voicedrop
Clone the repo
git clone --depth 1 https://github.com/jianshuo/claude-skills

Made for: Claude Code, Codex.

Its marketplace also offers this one on its own, as the plugin wjs-voicedrop/plugin install wjs-voicedrop after adding the marketplace above.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for wjs-voicedrop

README.md
[![agentmods](https://agentmods.dev/badge/skills/jianshuo/claude-skills/wjs-voicedrop/github.svg)](https://agentmods.dev/skills/jianshuo/claude-skills/wjs-voicedrop)
Your own site
<a href="https://agentmods.dev/skills/jianshuo/claude-skills/wjs-voicedrop"><img src="https://agentmods.dev/badge/skills/jianshuo/claude-skills/wjs-voicedrop/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for wjs-voicedrop

Your own site · 80×15
<a href="https://agentmods.dev/skills/jianshuo/claude-skills/wjs-voicedrop"><img src="https://agentmods.dev/badge/skills/jianshuo/claude-skills/wjs-voicedrop.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 164 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,943 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 1 finding. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector warn 7 Sept 2026
SkillSpector: 4 findings, up to high

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

  • high Supply Chain · line 35
    Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
    Fix: Avoid downloading and executing remote scripts. Use trusted packages from PyPI/npm. If remote fetch is required, verify checksums and use HTTPS.
  • high Supply Chain · line 35
    Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
    Fix: Avoid downloading and executing remote scripts. Use trusted packages from PyPI/npm. If remote fetch is required, verify checksums and use HTTPS.
  • medium Data Exfiltration · line 35
    Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
    Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
  • medium Data Exfiltration · line 116
    Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
    Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00164 $0.01943
Opus 5 $0.00082 $0.00971
Sonnet 5 $0.00033 $0.00389
Haiku 4.5 $0.00016 $0.00194

Measured 13d ago against content hash deab37f7aa1b, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-12, from the pricing page.

Security

Grade A, and why

wjs-voicedrop scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 13d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

`login` 是**唯一免 token 的工具**(要 token 才能登录、要登录才能拿 token,那是死锁)。所以**不必先接 MCP,也不必装任何东西**——curl 直接打端点:
wjs-voicedrop/SKILL.md · 126 lines

How it starts

The opening of the file, as written. The whole thing — 126 lines — stays where its author put it; the contents beside it link to each section on GitHub.

VoiceDrop

VoiceDrop 的全部能力都在 MCP 里。这个 skill 唯一的作用,是把你接上去。

先看:接上了吗?

会话里已经有 list_articlesread_stylecommunity_feedcredit_balance 这些工具?

接上了。停止阅读本文件,直接用工具。

工具自带完整说明(参数、语义、花不花算力都写在描述里)。本文件有意不重复它们——重复就会漂移:改了 MCP 忘了改这里,你就会照着过期的文档干活。单一真源是 MCP 自己。

没接上的话,往下走。全程两步:登录拿令牌 → 接进客户端。


第一步:登录(MCP 的 login 工具,6+4 手机配对)

一个工具,调两次。 靠字段分辨阶段——第一步只传 code,第二步只传 verify_code + pairing

login(code="a3f2b1")                    → 手机弹出 4 位码,返回 pairing 句柄
login(verify_code="7391", pairing="…")  → 返回 anon_ 令牌

为什么两次往返省不掉:4 位码是服务端在第一步才随机生成的——第一步之前它不存在。而且它是安全性的核心:6 位码可能同时匹配多个账号(最多 10 个),服务端给每个候选推不同的 4 位码。报对了,才同时证明「手机在你手上」和「你要的是哪个账号」。省掉它,猜个 6 位码 + 手机上误点一下就能被接管。

MCP 还没接上,怎么调它的工具?

login唯一免 token 的工具(要 token 才能登录、要登录才能拿 token,那是死锁)。所以不必先接 MCP,也不必装任何东西——curl 直接打端点:

VD=https://voicedrop.cn/mcp
call() {  # $1=工具名  $2=参数 JSON
  curl -s -X POST "$VD" -H 'Content-Type: application/json' \
    -d "{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"tools/call\",\"params\":{\"name\":\"$1\",\"arguments\":$2}}" \
    | python3 -c "import json,sys;r=json.load(sys.stdin)['result'];t=r['content'][0]['text'];print('ERR: '+t if r['isError'] else t)"
}
  1. 问用户要手机 设置 → 账户 里的 6 位十六进制码

    call login '{"code":"a3f2b1"}'
    # → {"pairing":"…", "next":"看手机——App 里会弹出一个 4 位数字码…"}
    
  2. 手机上会弹出 4 位数字码(也会收到一条推送「有新设备要登录」)。问用户要那个码:

    call login '{"verify_code":"7391","pairing":"<上一步返回的 pairing 原样粘回来>"}'
    # → {"token":"anon_…", "scope":"users/anon-…/", "next":"…"}
    

节奏很重要(这几条是真机上流血换来的)

  • 配对只活 2 分钟。 拿到 6 位码立刻发起,拿到 4 位码立刻完成。中间不要聊天、不要解释、不要顺手干别的——超时就得整个重来。
  • 用户报完 4 位码后,多半会切回电脑。 App 一进后台,服务端的「放行」消息就送不到手机。这时手机会收到第二条推送「确认登录」——提醒用户立刻点它;或者手动把 App 切回前台,登录会自动完成(服务端存着待办,回前台自动补送)。
  • 手机没弹码? 让用户把 App 切到前台就行——码会自动补送出来,不必重新发起。

报错对照

报错 含义 / 怎么办
没找到这个账号 6 位码抄错,或手机离线/未登录该账号
验证码不对,还能再试 N 次 4 位码错了。配对还活着,报个对的重调一次 login 就行,别重来
验证码不对,还能再试 ? 次 注意那个 ? —— 它说明配对已经不存在了(多半超过 2 分钟过期),必须重新发起,不是码错
手机没有响应 手机没放行。让用户点「确认登录」推送,或把 App 切回前台
你在手机上点了「不是我」 用户拒绝了这次登录

Read the full file on GitHub · 126 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 13d ago First seen · 126 lines · 164 tokens per session scan A deab37f7aa1b

Subscribe to this mod's changes

wjs-voicedrop is a skill published in the GitHub repository jianshuo/claude-skills (129 stars, last pushed 23d ago), licensed MIT. It adds 164 tokens to every session and 1,943 once invoked, about $0.0008 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

exploratory-data-analysis

Perform bounded, local exploratory analysis of explicitly supported scientific files. Use for redacted CSV/TSV/JSON profiles; optional NumPy, HDF5, FASTA/FASTQ, and basic image metadata inspection; missingness/leakage audits; outlier and transformation sensitivity; and rigorous EDA report scaffolds. Other domain…

K-Dense-AI/scientific-agent-skills · 83 tokens

google-ads-audit

Google Ads account audit and business context setup. Use for account-health audits and business-context setup. Trigger on "audit my ads", "ads audit", "set up my ads", "onboard", "account overview", "how's my account", "ads health check", "what should I fix in my ads", or when the user is new to NotFair and hasn't run…

nowork-studio/notfair-plugin · 86 tokens

data-charts-tako

Search and visualize the world's data - get charts, insights, and embeddable knowledge cards for finance, economics, demographics, sports, and more.

gooseworks-ai/goose-skills · 35 tokens

webhook-management

Configure and validate CCAM webhook targets across supported chat, incident, automation, and generic providers. Use when listing provider requirements, creating or updating a target, scoping it to alert rules, sending a test notification, reviewing delivery history, or deleting a target.

hoangsonww/Claude-Code-Agent-Monitor · 56 tokens

gesellschaftsrechtliche-satzungen-agb

Für Gesellschaftsrechtliche Satzungen AGB Abgrenzung: ordnet Norm, Beweislast und Gegenargument; Ergebnis: Prüfprodukt mit Risiko und nächstem Schritt. Fachgebiet: AGB-Recht-Prüfer. Route: gesellschaftsrechtliche-satzungen-agb.

Klotzkette/claude-fuer-deutsches-recht · 69 tokens

master-yinguang

A reference-based assistant for questions about Yinguang and Pure Land Buddhism, a Buddhist tradition focused on faith, ethical living, and practice connected with rebirth in the Pure Land. It can answer in Yinguang’s historical teaching style.

xr843/Master-skill · 274 tokens