Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/wecomteam/wecom-cli/wecomcli-medianpx skills add WecomTeam/wecom-cli --skill wecomcli-mediagit clone --depth 1 https://github.com/WecomTeam/wecom-cliWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/wecomteam/wecom-cli/wecomcli-media)<a href="https://agentmods.dev/skills/wecomteam/wecom-cli/wecomcli-media"><img src="https://agentmods.dev/badge/skills/wecomteam/wecom-cli/wecomcli-media.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00110 | $0.01470 |
| Opus 5 | $0.00055 | $0.00735 |
| Sonnet 5 | $0.00022 | $0.00294 |
| Haiku 4.5 | $0.00011 | $0.00147 |
Grade A, and why
wecomcli-media scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- **CLI 报错原样转达**:命令返回明确错误码时如实告知用户并给替代建议,禁止用 curl / python 等通用手段绕过 CLI 强行完成。 Copies of this mod
1 near-identical copy found in the catalogue:
- wecomcli-media — 100% identical, 3 lines differ
How it starts
The opening of the file, as written. The whole thing — 99 lines — stays where its author put it; the contents beside it link to each section on GitHub.
企业微信媒体文件
执行任何
wecom-cli命令前,必须先读取并完成wecomcli-shared技能的公共前置检查。
资源型 skill,负责基于 media_id 下载媒体文件到本地,以及把本地文件上传为 media_id。是其他技能(微盘、邮件等)处理 media_id 相关操作的基础依赖:upload 会产出新的 media_id,但本 skill 不负责搜索/发现其他业务场景中已存在的 media_id(如邮件附件、微盘文件的 media_id 由对应业务技能产出),也不解析文件内容。
适用范围
适用
- 根据其他技能或用户提供的
media_id下载媒体文件到本地 - 上传本地文件(本地路径已知)获取
media_id,供其他技能后续使用(如微盘上传素材)
不适用
- 解析/识别文件内容(正文提取、OCR、看图问答、PDF/Word/Excel 解析等) → 本 skill 只负责把文件下载到本地拿
file_path,如需查看内容请直接通过file_path读取该本地文件 - 搜索/发现其他业务场景中已存在的
media_id(如邮件附件、微盘文件列表/搜索等) → 由对应业务技能负责产出并返回media_id,本 skill 只接收已有的media_id做下载;本地文件转media_id的场景仍走本 skill 的upload - 编造或猜测
media_id/ 本地文件路径 → 两者必须来自其他技能返回或用户明确提供,禁止自行构造
接口详述
下载媒体文件
根据 media_id 下载媒体文件到本地,返回本地文件路径。
命令
wecom-cli media download --json '{"media_id": "MEDIA_ID"}'
入参
| 字段 | 类型 | 必填 | 说明 |
|---|---|---|---|
media_id |
string | 是 | 文件的 media_id,由上传文件后获得,或由其他技能(邮件附件/内嵌图片等)返回 |
返回
| 字段 | 类型 | 说明 |
|---|---|---|
file_path |
string | 下载成功后的本地文件路径 |
使用规则
- 下载完成后如需查看文件内容,直接通过
file_path读取该本地文件。 - 下载失败时返回错误码和错误信息。
media_id必须是真正的 media_id,不接受任何形式的 URL:若拿到的是一个链接(如attach_url、正文里的图片/附件链接),不要把这个 URL 当作media_id传入本接口,会直接报错。尤其是命中work.weixin.qq.com/filepreview/security/特征的防泄漏加密链接,属于加密的、与用户身份绑定的资源,本接口无法下载或解密,应直接告知用户该文件受防泄漏策略保护,引导其点击链接、在企业微信客户端内打开查看/保存,不要尝试用本接口或其他手段绕过。
上传媒体文件
将本地文件上传,获取 media_id。
命令
wecom-cli media upload --json '{"file_path": "/tmp/example.pdf"}'
入参
| 字段 | 类型 | 必填 | 说明 |
|---|---|---|---|
file_path |
string | 是 | 需要上传的文件的本地路径 |
返回
| 字段 | 类型 | 说明 |
|---|---|---|
type |
string | 媒体类型:image(图片)/voice(语音)/video(视频)/file(文件) |
media_id |
string | 上传后的 media_id,供其他技能后续使用(如微盘upload 的 file_content_media) |
created_at |
string | 创建时间,格式:YYYY-MM-DD HH:mm:ss |
关键约束
media_id/file_path不得编造:media_id必须来自上传结果、其他技能返回或用户明确提供;file_path必须是真实存在的本地路径。两者都没有时用自然语言追问,禁止靠猜测凑一个。- 不做内容解析:本 skill 只负责文件的下载落地与上传,
download拿到file_path后如需查看内容,直接通过file_path读取,不在本 skill 职责范围内。 - 内部 ID 不外露:
media_id仅用于后续接口调用,禁止直接展示给用户;下载后的本地file_path同样不展示给用户。 - CLI 报错原样转达:命令返回明确错误码时如实告知用户并给替代建议,禁止用 curl / python 等通用手段绕过 CLI 强行完成。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 99 lines · 110 tokens per session scan A 54e5989b8783
wecomcli-media is a skill published in the GitHub repository WecomTeam/wecom-cli (3,014 stars, last pushed 9d ago), licensed MIT. It adds 110 tokens to every session and 1,470 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
brainstorming
You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation.
auto-perf-optimize
Run agent-driven VS Code performance or memory investigations. Use when asked to launch Code OSS, automate a VS Code scenario, run the Chat memory smoke runner, capture renderer heap snapshots, take workflow screenshots, compare run summaries, or drive a repeatable scenario before heap-snapshot analysis.
chat-perf
Run chat perf benchmarks and memory leak checks against the local dev build or any published VS Code version. Use when investigating chat rendering regressions, validating perf-sensitive changes to chat UI, or checking for memory leaks in the chat response pipeline.
chat-pet-sprite-creation
Use when creating or changing VS Code chat pet sprite art, sprite sheets, state animations, eye treatments, Stable/Insiders variants, or pet transitions under src/vs/workbench/contrib/chat/browser/widget/media/chatPet.
cpu-profile-analysis
Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…