{
  "$schema": "https://bestaiskill.com/schemas/agent-install/2.json",
  "skill": "baoyu-post-to-wechat",
  "built": "2026-10-26",
  "control_level": 5,
  "control_level_label": "L5 严管",
  "capabilities": [
    "reverse_api",
    "terms_compliance",
    "credential",
    "execute_command",
    "network",
    "write_file"
  ],
  "required_controls": {
    "agent": [
      "isolated_environment",
      "per_use_authorization"
    ],
    "admin": [
      "strict_authorization",
      "full_audit",
      "compliance_signoff"
    ]
  },
  "evidence": [
    {
      "file": "SKILL.md / 脚本",
      "summary": "Calls undocumented or reverse-engineered private APIs / Spoofs client identity"
    },
    {
      "file": "SKILL.md / 脚本参数",
      "summary": "Bypasses automation detection, disables host sandbox, or skips SSL certificate verification"
    },
    {
      "file": "SKILL.md / 会话存储",
      "summary": "Reads or reuses browser user login sessions and session cookies"
    },
    {
      "file": "scripts/",
      "summary": "Executes local script or command: bun {baseDir}/scripts/wechat-api.ts <file> --theme … [--remote …] (API route)"
    },
    {
      "file": "网络端点",
      "summary": "Declares external network access: https://api.weixin.qq.com (token / uploadimg / add_material / draft/add) — usable"
    },
    {
      "file": "本地工作目录",
      "summary": "File read/write and artifact output: Locally rendered HTML to be pasted and processed body image artifacts (for WeChat upload)"
    }
  ],
  "verification": {
    "method": "第二遍独立重读 + 反查：① 全目录清单（SKILL.md、references/ 5 份、scripts/ 19 个文件含 6 份测试与 bun.lock）；② 端点反查：grep https:// 逐条落地（api.weixin.qq.com 四个端点、mp.weixin.qq.com、api.telegram.org），确认无其他外发域名；③ 凭证反查：grep process.env / .env / app_secret / identity_file，确认凭证来源链与 wechat-extend-config.ts 实现一致；④ 判红反查：grep bypass|synthetic|detect|automation|webdriver|stealth，命中 cdp.ts 的 AutomationControlled 与 paste-from-clipboard.ts 的自述文案，再核对调用路径（cdp.ts 是浏览器流程启动函数；paste 助手在本文档已注明未被主流程引用）；⑤ 反向确认无其他红线：全目录 grep no-sandbox / rejectUnauthorized / insecure / NODE_TLS_REJECT 零命中；⑥ 元数据核对：HEAD=1567581c26ec、LICENSE=MIT、stars 25926、pushed_at=2026-09-10T15:13:43Z。",
    "second_pass": [
      {
        "item": "反自动化检测绕过（判红主因）",
        "status": "ok",
        "detail": "scripts/cdp.ts:125 `extraArgs: ['--disable-blink-features=AutomationControlled', '--start-maximized'],` 由 launchChromeBase 传给 Chrome（浏览器脚本共用）；scripts/paste-from-clipboard.ts:5-7 明写 'This bypasses CDP's synthetic events which websites can detect and ignore.'"
      },
      {
        "item": "该绕过是否真的在发布路径上",
        "status": "ok",
        "detail": "cdp.ts 的 Chrome 启动函数是 wechat-browser.ts 与 wechat-article.ts 的入口（两者都从 cdp.ts 导入并把自动化参数交给 launchChromeBase）；paste 助手本身在本 commit 未被这两个主流程引用，已在 reason/injection_surface 如实标注程度。"
      },
      {
        "item": "凭证读取链",
        "status": "ok",
        "detail": "wechat-extend-config.ts 的 loadCredentials 依次尝试 EXTEND.md account → 前缀 env/.env → WECHAT_APP_ID/WECHAT_APP_SECRET（process.env、cwd .env、home .env），与 SKILL.md 描述一致。"
      },
      {
        "item": "微信 API 端点与 payload 规则",
        "status": "ok",
        "detail": "wechat-api.ts 常量区四个 URL 与 SKILL.md 的 draft/add payload rules（article_type/thumb_media_id/need_open_comment/only_fans_can_comment/content_source_url）逐项对应。"
      },
      {
        "item": "remote-api 的隧道实现与承诺",
        "status": "ok",
        "detail": "wechat-remote-publish.ts 组装 `-N -T -D 127.0.0.1:<port>` 等参数且仅用密钥（`if (config.identityFile) args.push(\"-i\", …)`）；SKILL.md 承诺不在远端落文件、AppSecret 不出本机——源码内确无远端文件写入路径（只建隧道与本地 SOCKS 出站）。"
      },
      {
        "item": "Telegram 二维码外发为可选",
        "status": "ok",
        "detail": "wechat-article.ts sendQrToTelegram 在 `if (!botToken || !chatId) return;` 之后才发请求；未配置即完全不走该路径。"
      },
      {
        "item": "依赖与剪贴板工具链",
        "status": "ok",
        "detail": "package.json/bun.lock 声明 jimp、@jsquash/webp、socks、baoyu-md、baoyu-chrome-cdp；copy-to-clipboard.ts 分别用 swift/osascript、wl-copy/xclip、powershell.exe，与 check-permissions.ts 的检查项一致。"
      },
      {
        "item": "无其他安全降级",
        "status": "ok",
        "detail": "全目录 grep no-sandbox / rejectUnauthorized / insecure / NODE_TLS_REJECT_UNAUTHORIZED 零命中；Chrome 启动参数仅常规项 + AutomationControlled。"
      },
      {
        "item": "元数据（license/stars/commit）",
        "status": "ok",
        "detail": "git HEAD=1567581c26ec29f4216c6e6835415bf30343b0e3；仓库根 LICENSE=MIT（Copyright (c) 2026 Jim Liu）；GitHub API stars=25926、pushed_at=2026-09-10T15:13:43Z。"
      }
    ],
    "level": 2,
    "level_label": "V2 已复核",
    "commit": "1567581c26ec29f4216c6e6835415bf30343b0e3",
    "sha256": "1f149b01778641d80a9e28c092133f5e608d06c5640b313c276781d415390061",
    "reviewed_by": "skills-bayx-audit",
    "reviewed_at": "2026-10-25"
  },
  "assessed_at": "2026-10-25",
  "method_version": "2.0",
  "mirror": {
    "archive": "https://skillpub.pages.dev/r2/v/2026-09-15/baoyu-post-to-wechat.tar.gz",
    "sha256": "1f149b01778641d80a9e28c092133f5e608d06c5640b313c276781d415390061",
    "commit": "1567581c26ec29f4216c6e6835415bf30343b0e3"
  },
  "original": {
    "github": "https://github.com/JimLiu/baoyu-skills/tree/main/skills/baoyu-post-to-wechat",
    "path": "skills/baoyu-post-to-wechat",
    "commit": "1567581c26ec29f4216c6e6835415bf30343b0e3"
  }
}