Home / All Skills / Content & Media Creation / canghe-post-to-wechat
English (EN)简体中文 (ZH)日本語 (JA)
Content & Media Creation · freestylefly/canghe-skills

canghe-post-to-wechat

Posts content to WeChat Official Account (微信公众号) via API or Chrome CDP. Supports article posting (文章) with HTML, markdown, or plain text input, and image-text posting (贴图, formerly 图文) with multiple images. Use when user mentions "发布公众号", "post to wechat", "微信公众号", or "贴图/图文/文章".

L5 Restricted · Isolated sandbox & strict auditV2 Human-AuditedTerms / ComplianceCredential / SessionExecute CommandNetwork AccessWrite FileDual-pass Audit
Author freestyleflyGitHub freestylefly/canghe-skills ↗License MIT（仓库根 LICENSE）Commit dd0bf35595
Control levels describe skill capabilities and suggested control measures; they do not represent quality or safety certifications, nor do they dictate usability. Usage decisions rest entirely with users and administrators. Different agent hosts apply varying constraints; do not assume hosts provide automatic protection. Third-party skill copyrights belong to their original authors. Use at your own risk.

1How It Works & Mechanism

Dual-channel publishing: either via the WeChat Official Account Platform API (wechat-api.ts, draft interface) or via browser CDP (wechat-article.ts / wechat-browser.ts driving real Chrome).

skills/canghe-post-to-wechat/SKILL.md
Posts content to WeChat Official Account (微信公众号) via API or Chrome CDP.
What is happening here: The opening sentence of SKILL.md declares two publishing routes; later Step 5 lets the user choose between api (fast) or browser (slow).

The workflow is a checklist-based Step 0-7, and initial setup is defined as a blocking action: no other steps or questions are permitted until EXTEND.md is ready.

skills/canghe-post-to-wechat/references/config/first-time-setup.md
**BLOCKING OPERATION**: This setup MUST complete before ANY other workflow steps.
What is happening here: Turning preference gathering into a hard gate to prevent the agent from rushing into content/publishing steps when unconfigured.

Credentials for the API path come from .env: WECHAT_APP_ID / WECHAT_APP_SECRET, with a 3-tier priority of environment variables → project .canghe-skills/.env → user ~/.canghe-skills/.env.

skills/canghe-post-to-wechat/SKILL.md
test -f .canghe-skills/.env && grep -q "WECHAT_APP_ID" .canghe-skills/.env && echo "project"
What is happening here: Step 5 uses Bash to detect credentials across the two-tier .env files, guiding the user to fetch AppID/AppSecret from the Official Account platform and write them if missing.

Draft request body rules are hardcoded: POST draft/add, article_type set to news/newspic, news requires thumb_media_id, and explicitly carries comment toggle fields.

skills/canghe-post-to-wechat/SKILL.md
- Use endpoint: `POST https://api.weixin.qq.com/cgi-bin/draft/add?access_token=ACCESS_TOKEN`
What is happening here: Step 6 specifies API payload details (endpoint, type, mandatory cover, need_open_comment/only_fans_can_comment resolution priority).

The browser path uses real Chrome + CDP, disabling automation flags with --disable-blink-features=AutomationControlled.

skills/canghe-post-to-wechat/scripts/cdp.ts
'--disable-blink-features=AutomationControlled',
What is happening here: Actively stripping automation flags via startup parameters constitutes a technical bypass of anti-automation detection (also present in wechat-browser.ts:345).

Sticker/image-text pastes images into the editor: markdown images are first replaced with WECHATIMGPH_n placeholders, and after pasting HTML, placeholders are located one by one, deleted, and replaced by pasting the image.

skills/canghe-post-to-wechat/references/article-posting.md
3. **Paste**: HTML content is pasted into WeChat editor
What is happening here: The four-step Image Handling (Parse→Render→Paste→Replace) is the core image-pasting mechanism for browser-based publishing.

Clipboard writing relies on inline Swift/AppKit: the script writes a snippet of Swift source code to a temporary file, then compiles and executes it to support image/rich text clipboards.

skills/canghe-post-to-wechat/scripts/copy-to-clipboard.ts
await writeFile(swiftPath, getMacSwiftClipboardSource(), 'utf8');
What is happening here: Part of cross-platform clipboard adaptation (macOS side); Linux/Windows have corresponding implementations.

markdown→HTML conversion is delegated to canghe-markdown-to-html, sharing command and theme options.

skills/canghe-post-to-wechat/SKILL.md
npx -y bun ${MD_TO_HTML_SKILL_DIR}/scripts/main.ts <markdown_file> --theme <theme>
What is happening here: Step 2/3 first discovers canghe-markdown-to-html, then converts and parses JSON via its main.ts (htmlPath/title/summary/contentImages).

The preflight script checks Chrome, profile isolation, Bun, accessibility permissions, clipboard, paste keystrokes, API credentials, and Chrome conflicts.

skills/canghe-post-to-wechat/SKILL.md
Checks: Chrome, profile isolation, Bun, Accessibility, clipboard, paste keystroke, API credentials, Chrome conflicts.
What is happening here: check-permissions.ts is an optional preflight check; upon failure, SKILL.md provides step-by-step remediation guidance.

2Core Capabilities

01API publishing (Draft): calls WeChat draft interface via wechat-api.ts
02Browser publishing (Article): drives real Chrome via wechat-article.ts
03Multi-image posting for stickers/image-text (up to 9 images, automatic compression for title/content exceeding limits)
04Image placeholder → real keystroke paste workflow (WECHATIMGPH_n location and replacement)
05Metadata validation and auto-generation (title/summary/cover, cover fallback to imgs/cover.png)
06Comment toggle control (need_open_comment / only_fans_can_comment)
07Externalized preferences in EXTEND.md (default theme/publish mode/author/comment toggle/Chrome profile) with guided first-time setup
08Environment preflight checks (Chrome/permissions/clipboard/keystrokes/credentials/conflicts)

3External Dependencies

KindDependency / Endpoint
api微信公众平台草稿接口（draft/add）
network微信公众平台（凭证申请/草稿管理页）
clibun（经 npx -y 即时拉取）
cliGoogle Chrome（CDP）+ osascript / xdotool / ydotool（真实键击贴图）

4Recommended Governance & Evidence

Suggested Controls for Safe Operation
For Agent Runtime
Isolated environment, per-use explicit authorization
For Administrators
Strict authorization, full audit, compliance signoff
Evidence & Triggers (File Paths & Excerpts)
  • SKILL.md / 脚本参数: Bypasses automation detection, disables host sandboxing, or skips SSL certificate verification
  • SKILL.md / 会话存储: Reads or reuses browser user login states and session cookies
  • 本地凭据 / 浏览器配置: Reads user login cookies/sessions/keyrings: Browser path reuses the Official Account login state from the shared Chrome profile (session cookies reside in the profile)
  • scripts/: Executes local scripts or commands: npx -y bun ${SKILL_DIR}/scripts/wechat-api.ts / wechat-article.ts / wechat-
  • 网络端点: Declares external network access: WeChat draft interface POST https://api.weixin.qq.com/cgi-bin/draft/add?access_token=ACCESS
  • 本地工作目录: File read/write and artifact output: Creates post-to-wechat/yyyy-MM-dd/[slug].md on plain text input (mkdir -p + file write)
Audit Notes: (Capability/policy-level determination, non-malicious implant). Two red lines: ① Technical bypass of anti-automation detection—browser path launches real Chrome with --disable-blink-features=AutomationControlled (cdp.ts:220, wechat-browser.ts:345), and image pasting primarily relies on real osascript Cmd+V keystrokes; triggers the 'anti-scraping/evasion' red flag (precedents: baoyu-post-to-wechat, baoyu-post-to-x, notebooklm-skill). ② Credential surface and external side effects—API path reads WECHAT_APP_ID/WECHAT_APP_SECRET via .env to invoke WeChat draft interface (draft/add) on that account, and browser path reuses shared Chrome login state; publishing incurs irreversible side effects under the user's account. Cross-skill invocation of canghe-markdown-to-html does not trigger transitive risk tier elevation, documented only in reason/risks.

5Second-Pass Verification

  • [ok] 双通道实现原理 — SKILL.md 描述、脚本清单与 Step 5/6 命令三处互证 api 与 browser 两条路径。
  • [ok] 反自动化绕过 — 风险扫描在 cdp.ts:220 与 wechat-browser.ts:345 各定位一条 --disable-blink-features=AutomationControlled，判红据成立。
  • [ok] 凭证读取 — SKILL.md 的 .env 探测命令、凭证引导流程与 Config File Locations 三级优先级一致。
  • [ok] 微信 API 端点与报文规则 — draft/add 端点在 SKILL.md Step 6 与 Feature Comparison 中一致出现，含 thumb_media_id 与评论字段规则。
  • [ok] 贴图占位符机制 — article-posting.md 的 Parse/Render/Paste/Replace 四步与 image-text-posting.md 说明自洽。
  • [unlocatable] 主脚本正文细节 — wechat-api.ts / wechat-article.ts / wechat-browser.ts 全文未在 bundle 展开，取 token、DOM 操作等细节以 SKILL.md 与扫描行为据，未代码级复核。
  • [ok] 跨 skill 依赖 canghe-markdown-to-html — SKILL.md Step 2/3 明写发现与调用，属他人 skill 行为，不参与本 skill 判级。
  • [ok] 插件/镜像等供应链线索 — 除 npx -y bun 即时拉取与自带 md 子集外，未在 bundle 内发现第三方镜像或远程包注入。

6Verdict & Scenarios

  • Dual-channel coverage for all publishing scenarios: API is fast and structured, while the browser path covers stickers and rich interactive editors unsupported by the API.
  • High level of engineering rigor: checklist workflow, BLOCKING initial setup, environment preflight, and step-by-step remediation guides lower the barrier to entry.
  • Thorough WeChat ecosystem details: mandatory covers, comment toggles, title/content compression, and image placeholder paste workflows.
    • Best for: Content operators who need to publish Markdown/HTML/plain text articles or image-text to WeChat Official Accounts, especially automation scenarios requiring comment toggles and sticker paste workflows.
    Not for: Users who do not permit third-party automated operations on Official Account credentials; environments unwilling to read/store AppID·AppSecret or reuse browser login states.
    Install Agent-Ready
    ① Verified Mirror 2026-10-10
    Option A · Direct DownloadDownload canghe-post-to-wechat.tar.gz
    sha256: 1efd21eef0ed6ee4…
    Option B · Copy Guide for Agent
    install.json
    Agents automatically download and verify mirrors from this JSON guide.
    ② Upstream GitHub
    GitHub Repo ↗
    Pinned to commit dd0bf35595.