Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Morningstar202604/awesome-skillkit --skill wechat-mp-publishergit clone --depth 1 https://github.com/Morningstar202604/awesome-skillkitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/morningstar202604/awesome-skillkit/wechat-mp-publisher)<a href="https://agentmods.dev/skills/morningstar202604/awesome-skillkit/wechat-mp-publisher"><img src="https://agentmods.dev/badge/skills/morningstar202604/awesome-skillkit/wechat-mp-publisher/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/morningstar202604/awesome-skillkit/wechat-mp-publisher"><img src="https://agentmods.dev/badge/skills/morningstar202604/awesome-skillkit/wechat-mp-publisher.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00084 | $0.00888 |
| Opus 5 | $0.00042 | $0.00444 |
| Sonnet 5 | $0.00017 | $0.00178 |
| Haiku 4.5 | $0.00008 | $0.00089 |
Grade A, and why
wechat-mp-publisher scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
微信公众号发布 Skill
compatibility
- Python 3.8+（仅标准库，无第三方依赖）
- 已认证的公众号（服务号/订阅号均可），在后台「设置与开发 → 基本配置」拿到 AppID/AppSecret
- 草稿箱与 freepublish 接口要求公众号已获得发布接口权限（大部分认证号默认有）
凭据管理
凭据不随技能分发，两种方式提供：
export WECHAT_MP_APPID=wx你的appid
export WECHAT_MP_SECRET=你的secret
或命令行 --appid / --secret。secret 等同密码，禁止写入任何文件进仓库。
IP 白名单：需把执行机器的出口 IP 加入公众号后台的 IP 白名单，否则 token 返回 errcode 40164。
安全规则（必须遵守）
- 默认 dry-run：所有写操作不加
--execute只打印请求计划，绝不联网发送 - AI 在 dry-run 输出展示给用户确认后，才能追加
--execute执行 - 发布前先跑内容检查（markdown→HTML 转义、图片 URL 可访问）
工作流
1. 获取 access_token
python3 scripts/wechat_mp_publish.py --execute token
token 有效期 7200 秒，脚本每次操作自动获取，无需缓存。
2. 上传封面图（永久素材，返回 media_id）
封面必须是永久素材 media_id（uploadimg 的临时 url 不能当封面）：
python3 scripts/wechat_mp_publish.py --execute add-thumb cover.jpg
3. 创建草稿
先把 Markdown 转 HTML（标题 h2 起、代码块转义），然后：
python3 scripts/wechat_mp_publish.py --execute add-draft \
--title "文章标题" \
--content-html article.html \
--thumb-media-id <第2步返回的media_id> \
--author "作者" \
--digest "摘要"
返回 media_id 即草稿 ID。
4. 提交发布
python3 scripts/wechat_mp_publish.py --execute publish <草稿media_id>
发布是异步的：返回 ok 后用 freepublish/get 查询发布状态；发布后文章在公众号后台「发表记录」可见。
常见错误码
| errcode | 含义 | 处理 |
|---|---|---|
| 40001 | appid/secret 错误 | 核对凭据 |
| 40164 | IP 不在白名单 | 公众号后台加白 |
| 45009 | 频率限制 | 等待后重试 |
| 53401 | 封面 media_id 无效 | 用 add-thumb 重新上传 |
| 53404 | 文章被判定违规 | 人工修改内容 |
官方文档
- 草稿箱: https://developers.weixin.qq.com/doc/offiaccount/Draft_Box/
- 发布能力: https://developers.weixin.qq.com/doc/offiaccount/Publish/Publish.html
- 素材管理: https://developers.weixin.qq.com/doc/offiaccount/Asset_Management/new_asset.html
接口字段以官方文档为准；若微信调整 API，以 DevTools/官方文档实测结果更新 scripts/wechat_mp_publish.py 顶部的端点常量。
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 94 lines · 84 tokens per session scan A 85efa0bbf8e2
wechat-mp-publisher is a skill published in the GitHub repository Morningstar202604/awesome-skillkit (1 stars, last pushed 2d ago), licensed Apache-2.0. It adds 84 tokens to every session and 888 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
dingtalk_channel_connect
Use a headed browser to automatically complete DingTalk channel integration for QwenPaw. Applicable when the user mentions DingTalk, developer console, Client ID, Client Secret, bot, Stream mode, binding or configuring a channel. Supports pausing when a login page is detected and resuming after the user logs in.
browser_cdp
Use this skill when the user explicitly wants to connect to a running Chrome browser, scan local CDP ports, specify a cdpport, or share a single browser across multiple agents/tools. By default browser opens no debugging port; pass an explicit cdpport only when the user wants another local tool to attach.
browser_cdp
Browser connection controls for finding local debugging ports, attaching to an already running Chrome browser, or sharing one browser between tools.
browser_visible
Browser launch controls for choosing whether a Chromium-based browser window is visible, which browser program to run, and which startup options to pass.
browser_visible
Use this skill when the user needs to control the browser launch mode for browser. By default browser is managed by Playwright and opens no debugging port (pass an explicit cdpport to let another local tool attach); headed controls whether the window is visible, and privatemode is kept for backward compatibility and…
ego-browser
When you need a browser, read this Skill by default. Use it to open and operate websites, fill forms, click buttons, take screenshots, extract page data, sign in, and perform other browser automation tasks, as well as web app testing, dogfooding, QA, bug investigation, and app-quality review. ego-browser (ego-lite) is…