md2wechat-765eb9 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited md2wechat-765eb9 (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill to operate the md2wechat CLI. Keep the skill focused on execution decisions. For full command tutorials, installation details, and FAQ-level explanations, refer users to the project docs instead of expanding this runtime protocol.
Choose the command family before taking any publish or generation action:
inspect, preview, and convert.newspic, or multi-image post: use create_image_post, not convert --draft.generate_cover or generate_infographic over raw generate_image when a bundled preset fits.--plan --json) to get prompt intent, then hand it to the host image-generation tool if one is available outside md2wechat.write or humanize.Treat convert --draft and create_image_post as different publish targets, not interchangeable variants.
Use CLI discovery as the source of truth, but keep it scoped to the next decision. Do not run the full catalog for tasks that do not need provider, theme, prompt, or layout selection.
Run the smallest useful discovery set:
md2wechat themes list --json
md2wechat layout list --json md2wechat themes show <name> --json
md2wechat providers show <name> --json
md2wechat prompts show <name> --kind <kind> --json
md2wechat layout show <name> --json md2wechat providers list --json
md2wechat prompts list --kind image --json md2wechat doctor --json
md2wechat config show --format json
md2wechat config wechat-accounts --jsondoctor readiness is local configuration attemptability. config wechat-accounts is local-only and never prints WeChat secrets. Use inspect --json for article-specific target readiness.
md2wechat version --json
md2wechat capabilities --json
md2wechat skills list --json
md2wechat skills read md2wechat --jsonmd2wechat skills read md2wechat --json reads the SOP embedded in the current CLI binary. Prefer it when the installed external skill, README, or repository checkout may be stale relative to the executable on PATH.
For simple local actions such as preview, humanize, or a user-specified command with explicit flags, do not run unrelated provider, theme, prompt, or layout discovery.
Inspect specific resources only when the task needs them:
md2wechat providers show <name> --json
md2wechat themes show <name> --json
md2wechat prompts show <name> --kind <kind> --json
md2wechat layout show <name> --jsonUse CLI output as the source of truth for currently available modes, providers, themes, prompts, and layout modules.
md2wechat is already available on PATH.convert defaults to API mode unless the user explicitly asks for --mode ai.MD2WECHAT_API_KEY; the CLI validates it before upload or draft side effects.--plan --json) only emits prompt intent for a host Agent or external tool and does not require image-provider credentials.doctor --json is local-only: it checks local readiness and does not perform live authentication, upload images, or create drafts.config show --format json when the user asks what configuration is currently effective.config wechat-accounts --json when the user asks which local WeChat accounts are configured.Prefer a confirm-first workflow for article work:
md2wechat inspect <article.md> --jsonmd2wechat preview <article.md>md2wechat convert <article.md> ...--upload, --draft, --cover, or --cover-media-id only when the user explicitly asks for upload or draft creation.inspect is the source-of-truth command for resolved metadata, readiness, and publish checks. In --json output, read data.readiness.targets and data.readiness.blockers before deciding whether convert, upload, or draft is blocked. Do not invent data.agent_readiness, data.target_readiness, ArticleState, state files, or a second planning object. preview is a local preview artifact. It does not upload images, create drafts, or write back to Markdown. convert --preview is the convert-path preview flag and is not the same as the standalone preview command. preview --mode ai is degraded confirmation only and must not be treated as final AI-generated layout.
When the user asks to format an article and has not chosen a theme or modules:
/tmp/md2wechat-format/<run-id>/article.formatted.md.md2wechat layout validate --file <formatted.md> --json.convert.Saving generated Markdown next to the source file requires explicit user confirmation and must not overwrite the source.
type and selectable from themes list --json.type: api and selectable: true themes.type: ai and selectable: true themes.Advanced layout modules render only in API mode. AI mode (--mode ai) does not parse :::module syntax, so advanced layout cards will not render there.
Use this decision frame:
attention: help readers decide whether the article is worth reading.readability: make mobile reading easier.memorability: make one judgment, quote, metric, or brand anchor stick.conversion: help readers save, follow, inquire, share, or buy.Use layout list --json and layout show <name> --json to inspect body_format. It is the module body syntax contract:
fieldsrowsjson_objectjson_arrayDo not infer syntax from examples alone. Use layout render when structured variables are enough; otherwise write the block manually according to body_format and validate the generated Markdown.
Default module discipline:
Brand Profile lives at ~/.config/md2wechat/brand.md.
Do not create drafts, upload images, publish, or call remote image generation unless the user asks for that action.
Before draft creation:
inspect --json and check data.readiness.targets.draft; when blocked, read matching data.readiness.blockers.--cover or --cover-media-id.mmbiz.qpic.cn URL can be reused as thumb_media_id.45004, check digest, summary, and description before assuming the body is too long.Markdown images are uploaded or replaced only during --upload or --draft, not during plain conversion or preview.
doctor --json and config show --format json; report data.overall plus the blocking data.readiness.* item.layout validate, inspect the failing module with layout show, fix the generated artifact, then validate again.layout list --json.type and selectable, then choose a compatible theme or ask the user.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.