gzh-design
微信公众号文章排版引擎，将 Markdown 转换为可直接粘贴到公众号编辑器的 HTML。主题风格从 references/theme-index.md 注册的自定义主题库中选取，自动章节编号、关键词下划线标记、引言卡片、目录导航、代码块、图片/GIF、作者签名。支持 Markdown / Word(.docx) / PDF / 纯文本输入（非 Markdown 先自动归一化），也支持"一键自动排版"（自动推断结构+选主题），还支持根据用户描述/参考图生成自定义主题组件库并保存本地复用。触发场景：(1) 用户提到"公众号排版""公众号文章""微信排版""gzh"，(2) 用户想把文章（md/docx/pdf/纯文本）转成公众号 HTML，(3) 用户说"自动排版""一键排版"公众号内容，(4) 用户想为公众号排版"生成新主题/自定义风格/按这张图做一套组件库"。不用于生成普通网页/落地页/PPT（用前端或 PPT 类 skill）。
78
100%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
High
Do not use without reviewing
Security
1 high severity finding. You should review these findings carefully before considering using this skill.
W008: Secret detected in skill content (API keys, tokens, passwords).
What this means
Detected sensitive credentials directly embedded within the skill content, such as API keys, access tokens, private keys, or service-specific secrets. Secrets should never be hardcoded in plain text within skill instructions.
Why it was flagged
I looked for literal, high-entropy credentials in the skill docs. I found a long "sealed_token=OSZCPLO_..." query parameter embedded in the star-history image URLs. That value is a non-trivial, random-looking token that could grant access to the external chart API and is not a generic placeholder — so it meets the "high-entropy / usable credential" definition and should be treated as a secret. I ignored many low-risk strings such as hex color codes (#xxxxxx), GitHub URLs, simple usernames (e.g., zuiyn_soul), and example text placeholders — none of those are secrets per your rules.
- Repository
- isjiamu/gzh-design-skill
- Path
SKILL.md
- Commit
ba1f417
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.