{
  "$schema": "https://bestaiskill.com/schemas/agent-install/2.json",
  "skill": "canghe-post-to-wechat",
  "built": "2026-10-26",
  "control_level": 5,
  "control_level_label": "L5 严管",
  "capabilities": [
    "terms_compliance",
    "credential",
    "execute_command",
    "network",
    "write_file"
  ],
  "required_controls": {
    "agent": [
      "isolated_environment",
      "per_use_authorization"
    ],
    "admin": [
      "strict_authorization",
      "full_audit",
      "compliance_signoff"
    ]
  },
  "evidence": [
    {
      "file": "SKILL.md / 脚本参数",
      "summary": "Bypasses automation detection, disables host sandboxing, or skips SSL certificate verification"
    },
    {
      "file": "SKILL.md / 会话存储",
      "summary": "Reads or reuses browser user login states and session cookies"
    },
    {
      "file": "本地凭据 / 浏览器配置",
      "summary": "Reads user login cookies/sessions/keyrings: Browser path reuses the Official Account login state from the shared Chrome profile (session cookies reside in the profile)"
    },
    {
      "file": "scripts/",
      "summary": "Executes local scripts or commands: npx -y bun ${SKILL_DIR}/scripts/wechat-api.ts / wechat-article.ts / wechat-"
    },
    {
      "file": "网络端点",
      "summary": "Declares external network access: WeChat draft interface POST https://api.weixin.qq.com/cgi-bin/draft/add?access_token=ACCESS"
    },
    {
      "file": "本地工作目录",
      "summary": "File read/write and artifact output: Creates post-to-wechat/yyyy-MM-dd/[slug].md on plain text input (mkdir -p + file write)"
    }
  ],
  "verification": {
    "method": "第二遍独立于第一遍：重新通读 bundle §2（SKILL.md / 三份 references / md 子集）、§1 清单与 §3 风险扫描命中行，逐条核对双通道实现、凭证读取、绕过手段与安全结论；未展开的 wechat-api.ts / wechat-article.ts / wechat-browser.ts 正文不臆测。",
    "second_pass": [
      {
        "item": "双通道实现原理",
        "status": "ok",
        "detail": "SKILL.md 描述、脚本清单与 Step 5/6 命令三处互证 api 与 browser 两条路径。"
      },
      {
        "item": "反自动化绕过",
        "status": "ok",
        "detail": "风险扫描在 cdp.ts:220 与 wechat-browser.ts:345 各定位一条 --disable-blink-features=AutomationControlled，判红据成立。"
      },
      {
        "item": "凭证读取",
        "status": "ok",
        "detail": "SKILL.md 的 .env 探测命令、凭证引导流程与 Config File Locations 三级优先级一致。"
      },
      {
        "item": "微信 API 端点与报文规则",
        "status": "ok",
        "detail": "draft/add 端点在 SKILL.md Step 6 与 Feature Comparison 中一致出现，含 thumb_media_id 与评论字段规则。"
      },
      {
        "item": "贴图占位符机制",
        "status": "ok",
        "detail": "article-posting.md 的 Parse/Render/Paste/Replace 四步与 image-text-posting.md 说明自洽。"
      },
      {
        "item": "主脚本正文细节",
        "status": "unlocatable",
        "detail": "wechat-api.ts / wechat-article.ts / wechat-browser.ts 全文未在 bundle 展开，取 token、DOM 操作等细节以 SKILL.md 与扫描行为据，未代码级复核。"
      },
      {
        "item": "跨 skill 依赖 canghe-markdown-to-html",
        "status": "ok",
        "detail": "SKILL.md Step 2/3 明写发现与调用，属他人 skill 行为，不参与本 skill 判级。"
      },
      {
        "item": "插件/镜像等供应链线索",
        "status": "ok",
        "detail": "除 npx -y bun 即时拉取与自带 md 子集外，未在 bundle 内发现第三方镜像或远程包注入。"
      }
    ],
    "level": 2,
    "level_label": "V2 已复核",
    "commit": "dd0bf355955b4c82b764740b4183c86a72ba0e0c",
    "sha256": "1efd21eef0ed6ee46d38e3076b89b798bb66f282d22e2e323484e48a81dbd49d",
    "reviewed_by": "skills-bayx-audit",
    "reviewed_at": "2026-10-25"
  },
  "assessed_at": "2026-10-25",
  "method_version": "2.0",
  "mirror": {
    "archive": "https://skillpub.pages.dev/r2/v/2026-10-10/canghe-post-to-wechat.tar.gz",
    "sha256": "1efd21eef0ed6ee46d38e3076b89b798bb66f282d22e2e323484e48a81dbd49d",
    "commit": "dd0bf355955b4c82b764740b4183c86a72ba0e0c"
  },
  "original": {
    "github": "https://github.com/freestylefly/canghe-skills/tree/main/skills/canghe-post-to-wechat",
    "path": "skills/canghe-post-to-wechat",
    "commit": "dd0bf355955b4c82b764740b4183c86a72ba0e0c"
  }
}