@acedatacloud/skills 2026.728.0 → 2026.728.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@acedatacloud/skills",
-  "version": "2026.728.0",
+  "version": "2026.728.2",
   "description": "Agent Skills for AceDataCloud AI services — music, image, video generation, LLM chat, web search. Compatible with Claude Code, GitHub Copilot, Gemini CLI, OpenAI Codex, and 30+ AI coding agents.",
   "keywords": [
     "agent-skills",

package/skills/bilibili/SKILL.md

@@ -54,7 +54,7 @@ Stats come straight from Bilibili: `view` (阅读), `like` (点赞), `reply` (
 ```sh
 BILI="$SKILL_DIR/scripts/bilibili.py"; [ -f "$BILI" ] || BILI=$(find /tmp -maxdepth 8 -path '*/skills/*/scripts/bilibili.py' 2>/dev/null | head -1)
 python3 "$BILI" whoami
-# → {"mid": 91207595, "name": "...", "level": 4}
+# → {"mid": 10000000, "name": "...", "level": 4}
 ```
 
 On a not-logged-in / auth error the cookie is expired — have the user reconnect

package/skills/csdn/SKILL.md

@@ -53,7 +53,7 @@ Stats come straight from CSDN: `view_count` (阅读), `digg_count` (点赞),
 ```sh
 CSDN="$SKILL_DIR/scripts/csdn.py"; [ -f "$CSDN" ] || CSDN=$(find /tmp -maxdepth 8 -path '*/skills/*/scripts/csdn.py' 2>/dev/null | head -1)
 python3 "$CSDN" whoami
-# → {"username": "...", "nickname": "...", "articles_total": 1597}
+# → {"username": "...", "nickname": "...", "articles_total": 0}
 ```
 
 On a WAF 403 / auth error the cookie is expired — tell the user to reconnect at

package/skills/discord/SKILL.md

@@ -63,15 +63,15 @@ python3 scripts/discord_user.py whoami
 # list the servers (guilds) the account is in
 python3 scripts/discord_user.py guilds
 # list text channels in a server
-python3 scripts/discord_user.py channels --guild 1133012399448928276
+python3 scripts/discord_user.py channels --guild GUILD_ID
 # read recent messages in a channel
-python3 scripts/discord_user.py messages --channel 1133012400174534792 --limit 20
+python3 scripts/discord_user.py messages --channel CHANNEL_ID --limit 20
 # send — dry-run first, then re-run with a trailing --confirm
-python3 scripts/discord_user.py send --channel 1133012400174534792 --text "hello"
-python3 scripts/discord_user.py send --channel 1133012400174534792 --text "hello" --confirm
+python3 scripts/discord_user.py send --channel CHANNEL_ID --text "hello"
+python3 scripts/discord_user.py send --channel CHANNEL_ID --text "hello" --confirm
 # reply to a specific message
 python3 scripts/discord_user.py reply \
-  --channel 1133012400174534792 --message 987654321098765432 --text "on it" --confirm
+  --channel CHANNEL_ID --message MESSAGE_ID --text "on it" --confirm
 ```
 
 `--confirm` is honored ONLY as the final argument (one strip), so a message body

package/skills/discord/scripts/discord_user.py

@@ -17,10 +17,10 @@ account access — NEVER echo or print it.
 Examples:
   python3 discord_user.py whoami
   python3 discord_user.py guilds
-  python3 discord_user.py channels --guild 1133012399448928276
-  python3 discord_user.py messages --channel 1133012400174534792 --limit 20
-  python3 discord_user.py send --channel 1133012400174534792 --text "hello" --confirm
-  python3 discord_user.py reply --channel 1133012400174534792 --message 987654321 --text "on it" --confirm
+  python3 discord_user.py channels --guild GUILD_ID
+  python3 discord_user.py messages --channel CHANNEL_ID --limit 20
+  python3 discord_user.py send --channel CHANNEL_ID --text "hello" --confirm
+  python3 discord_user.py reply --channel CHANNEL_ID --message MESSAGE_ID --text "on it" --confirm
 """
 
 from __future__ import annotations

package/skills/google-gmail/SKILL.md

@@ -383,7 +383,7 @@ BODY='Hi Alice,
 Just a quick test note from the AceDataCloud Gmail connector.
 
 Best,
-Qingcai'
+YOUR_NAME'
 
 # Multi-line subject lines need MIME encoded-word for non-ASCII; ASCII is fine raw.
 RAW=$(printf 'To: %s\r\nSubject: %s\r\nContent-Type: text/plain; charset=UTF-8\r\nMIME-Version: 1.0\r\n\r\n%s' \

package/skills/juejin/SKILL.md

@@ -47,7 +47,7 @@ Stats come straight from 掘金: `view_count` (阅读), `digg_count` (点赞),
 ```sh
 JJ="$SKILL_DIR/scripts/juejin.py"; [ -f "$JJ" ] || JJ=$(find /tmp -maxdepth 8 -path '*/skills/*/scripts/juejin.py' 2>/dev/null | head -1)
 python3 "$JJ" whoami
-# → {"user_id": "...", "name": "...", "post_article_count": 336}
+# → {"user_id": "...", "name": "...", "post_article_count": 0}
 ```
 
 On an auth error (`err_no` 401 / "请登录") the cookie is expired — have the user

package/skills/mastodon/SKILL.md

@@ -64,7 +64,7 @@ curl -sS -X POST "$MASTODON_BASE_URL/api/v1/statuses" \
 Use the `id` from `verify_credentials`:
 
 ```bash
-ACCT_ID="14715"   # from verify_credentials
+ACCT_ID="ACCOUNT_ID"   # from verify_credentials
 curl -sS "$MASTODON_BASE_URL/api/v1/accounts/$ACCT_ID/statuses?limit=20&exclude_replies=true&exclude_reblogs=true" \
   -H "Authorization: Bearer $MASTODON_ACCESS_TOKEN" \
   | jq '.[] | {id, url, boosts: .reblogs_count, favs: .favourites_count, replies: .replies_count, created_at}'

package/skills/personal-wechat/SKILL.md

@@ -98,7 +98,7 @@ python3 $WX conversations --history --limit 20
 First list conversations, then use the `id` as `conversation_id`:
 
 ```bash
-python3 $WX messages "34642176898@chatroom" --limit 50 --order asc
+python3 $WX messages "CONVERSATION_ID" --limit 50 --order asc
 ```
 
 ### Historical Messages
@@ -107,7 +107,7 @@ Read from Wisdom's decrypted WeChat local databases:
 
 ```bash
 python3 $WX history --limit 50
-python3 $WX history --talker "34642176898@chatroom" --limit 50
+python3 $WX history --talker "CONVERSATION_ID" --limit 50
 python3 $WX history --limit 20 --offset 20
 ```
 

package/skills/telegram/SKILL.md

@@ -51,7 +51,7 @@ last argument** so a message/caption that merely contains "--confirm" can never
 
 ```sh
 python3 "$TG" whoami
-# → {"id": 8367450178, "username": "GermeyAce", "name": "Germey", "phone": "..."}
+# → {"id": 100000000, "username": "<the connected handle>", "name": "<display name>", "phone": "..."}
 ```
 
 On an auth/session error the stored session is dead — tell the user to reconnect at

package/skills/toutiao/SKILL.md

@@ -54,7 +54,7 @@ Stats come straight from 头条: `impression_count` (展现), `read_count` (阅
 ```sh
 TT="$SKILL_DIR/scripts/toutiao.py"; [ -f "$TT" ] || TT=$(find /tmp -maxdepth 8 -path '*/skills/*/scripts/toutiao.py' 2>/dev/null | head -1)
 python3 "$TT" whoami
-# → {"user_id": ..., "name": "...", "articles_total": 273}
+# → {"user_id": ..., "name": "...", "articles_total": 0}
 ```
 
 On an auth error the cookie is expired — tell the user to reconnect at

package/skills/x/SKILL.md

@@ -50,8 +50,8 @@ python3 "$X" whoami          # confirm the shipped CLI can read the authenticate
 ## Read commands (run directly)
 
 ```sh
-python3 $X whoami --expect GermeyAce                         # verify this exact account
 python3 $X whoami                                            # discover the authenticated account
+python3 $X whoami --expect SCREEN_NAME                       # optional: assert a specific account
 python3 $X search --query "ai agents" --product Latest --limit 20   # Top | Latest | Media
 python3 $X search-users --query "openai" --limit 10
 python3 $X timeline --limit 20                               # my home timeline
@@ -65,19 +65,22 @@ python3 $X trends --category trending --limit 20             # trending|for-you|
 ## Verify the connection first
 
 ```sh
-python3 $X whoami --expect GermeyAce
-# → {"id": "...", "screen_name": "GermeyAce", "identity_verified": true, ...}
+python3 $X whoami
+# → {"id": "...", "screen_name": "<the connected handle>", "identity_verified": true, ...}
 ```
 
 `whoami` reads the authenticated account's screen name from X account settings,
-then resolves its public profile. `--expect` compares that server-authenticated
-screen name with the required account before any write. This avoids X's
-Cloudflare-blocked `UserByRestId` endpoint without trusting a local identity
-cookie. Always use `--expect` when the user names the required account.
+then resolves its public profile. This avoids X's Cloudflare-blocked
+`UserByRestId` endpoint without trusting a local identity cookie.
+
+`--expect <screen_name>` is optional: pass it only when the user explicitly names
+the account they want to act as, and it will abort if the connected cookie
+belongs to someone else. Do not invent an expected handle — plain `whoami` is
+the default.
 
 On an actual auth error the cookie is expired — have the user reconnect at
 <https://auth.acedata.cloud/user/connections>. A Cloudflare block is different:
-reconnecting cookies does not fix it. Use `--expect` for identity checks; other
+reconnecting cookies does not fix it. Use `whoami` for identity checks; other
 blocked endpoints need `X_PROXY` or the official X API. Do **not** loop-retry.
 
 ## Write commands — GATED (dry-run unless trailing `--confirm`)

package/skills/x/scripts/x.py

@@ -19,7 +19,7 @@ breakage.
 
 Examples:
   python3 x.py whoami
-    python3 x.py whoami --expect GermeyAce
+  python3 x.py whoami --expect SCREEN_NAME
   python3 x.py search --query "python" --product Latest --limit 20
   python3 x.py timeline --limit 20
   python3 x.py user-tweets --user elonmusk --type Tweets --limit 20
@@ -107,7 +107,7 @@ def cloudflare_block_message(error: Exception) -> str | None:
     ray = f" Ray ID: {ray_match.group(1)}." if ray_match else ""
     return (
         "X blocked this automated web-API request at Cloudflare; the login cookies may still be valid."
-        f"{ray} For identity checks, use `whoami --expect <screen_name>`; for other blocked endpoints, "
+        f"{ray} For identity checks, use `whoami`; for other blocked endpoints, "
         "configure X_PROXY or use the official X API."
     )
 

package/skills/yuque/SKILL.md

@@ -1,104 +1,125 @@
 ---
 name: yuque
-description: Read and write Yuque (语雀) documents with the user's own personal access token through the official open API at https://www.yuque.com/api/v2. Use when the user wants to publish Markdown to 语雀, list their knowledge bases (知识库), read or update a 语雀 document, or delete one.
+description: Read and write Yuque (语雀) documents on the user's own account — list knowledge bases (知识库), read a document, publish Markdown, and update or delete one. Works with either the user's browser login (free) or a personal access token. Use when the user wants to publish Markdown to 语雀, list their 语雀 knowledge bases, or read a 语雀 document.
 when_to_use: |
   Trigger for 语雀 / Yuque document management: verify the connected account,
   list knowledge bases or the documents inside one, read a document, create a
-  Markdown document, update an existing one, or delete one. Writes and
-  destructive actions require explicit confirmation.
+  Markdown document, and (token connections only) update or delete one.
+  Writes and destructive actions require explicit confirmation.
 connections: [yuque]
 allowed_tools: [Bash]
 license: Apache-2.0
 metadata:
   author: acedatacloud
-  version: "1.0"
+  version: "2.0"
 ---
 
-Use the bundled standard-library CLI. The connector injects the user's 语雀
-personal access token as `$YUQUE_TOKEN`. Never print it. The CLI uses the
-official open API at `https://www.yuque.com/api/v2` with the documented
-`X-Auth-Token` header.
+# 语雀 — two connection modes
 
-```bash
-python3 "$SKILL_DIR/scripts/yuque.py" whoami
-```
+The connector injects exactly one credential, and the CLI picks its mode from it:
 
-If `$SKILL_DIR` points at a different skill loaded in the same turn, resolve
-this skill's directory explicitly before running the commands below.
+- **`$YUQUE_COOKIES`** — the user's own browser login jar, captured by the ACE
+  extension. **Free.** Drives 语雀's internal web API.
+- **`$YUQUE_TOKEN`** — a 语雀 personal access token for the official open API.
+  **Requires a paid 语雀超级会员.**
 
-If authentication fails, ask the user to create a token at
-`https://www.yuque.com/settings/tokens` and reconnect at
-`https://auth.acedata.cloud/user/connections`. Do not ask for their account
-password or Cookie.
+Both are **secret — never echo, print, log or return them.** Every command
+reports the active mode back as `auth_mode`; read that instead of guessing.
 
-## Read
+| Command | cookie | token |
+|---|---|---|
+| `whoami`, `repos`, `docs`, `doc` | ✅ | ✅ |
+| `create` | ✅ | ✅ |
+| `update`, `delete` | ❌ refused with a clear error | ✅ |
+
+If the user asks to edit or delete on a cookie connection, tell them that needs
+a personal token (created at `https://www.yuque.com/settings/tokens`, 超级会员
+required) and offer to create a new document instead. Do not attempt a
+workaround.
 
-A `repo` is a 语雀 knowledge base, addressed either by its `namespace`
-(`user/book`, as shown in the document URL) or by its numeric id. Always run
-`repos` first — never guess a namespace.
+## Script resolution
 
-```bash
-# Verify the token and see the account.
-python3 "$SKILL_DIR/scripts/yuque.py" whoami
+Bash calls do not share shell variables. Resolve the helper inside **every**
+fenced Bash invocation before using it:
 
-# List knowledge bases, then the documents in one.
-python3 "$SKILL_DIR/scripts/yuque.py" repos
-python3 "$SKILL_DIR/scripts/yuque.py" docs germey/blog --limit 20
-python3 "$SKILL_DIR/scripts/yuque.py" doc germey/blog DOC_ID
+```sh
+Y="${SKILL_DIR:-}/scripts/yuque.py"; [ -f "$Y" ] || Y=$(find /tmp -maxdepth 8 -path '*/skills/*/yuque/scripts/yuque.py' -print -quit 2>/dev/null)
+[ -f "$Y" ] || { echo "yuque script not found (SKILL_DIR=$SKILL_DIR)" >&2; exit 1; }
+python3 "$Y" whoami
 ```
 
-## Create and update
+On an auth error, ask the user to reconnect at
+<https://auth.acedata.cloud/user/connections>. Never ask for their password,
+and never ask them to paste a Cookie into the chat.
 
-Prepare the complete Markdown in a file. 语雀 has no separate draft state — a
-document is either private or public — so the CLI creates **private** documents
-by default and only publishes publicly with an explicit `--public`.
+## Read
+
+A knowledge base (`repo`) is addressed by its `user/book` namespace or its
+numeric id. **Always run `repos` first — never guess a namespace or an id.**
+Pass back exactly the `repo_id` that `repos` printed; on a cookie connection a
+`user/book` namespace is resolved by matching the account's own knowledge
+bases, so it fails for a base the account does not own, and an ambiguous slug
+is refused rather than guessed.
+
+```sh
+Y="${SKILL_DIR:-}/scripts/yuque.py"; [ -f "$Y" ] || Y=$(find /tmp -maxdepth 8 -path '*/skills/*/yuque/scripts/yuque.py' -print -quit 2>/dev/null)
+python3 "$Y" repos
+python3 "$Y" docs REPO_ID --limit 20
+python3 "$Y" doc REPO_ID DOC_ID
+```
 
-```bash
-# First call is always a dry run and does not load credentials or call the API.
-python3 "$SKILL_DIR/scripts/yuque.py" create germey/blog \
-  --title "标题" --content-file /tmp/article.md
+## Create
+
+Prepare the complete Markdown in a file. 语雀 has no draft state — a document is
+either private or public — so the CLI creates **private** documents by default
+and only publishes publicly with an explicit `--public`.
+
+```sh
+Y="${SKILL_DIR:-}/scripts/yuque.py"; [ -f "$Y" ] || Y=$(find /tmp -maxdepth 8 -path '*/skills/*/yuque/scripts/yuque.py' -print -quit 2>/dev/null)
+
+# The first call is always a dry run: it loads no credentials and calls no API.
+python3 "$Y" create REPO_ID --title "标题" --content-file /tmp/article.md
 
 # Create it privately after the user confirms.
-python3 "$SKILL_DIR/scripts/yuque.py" create germey/blog \
-  --title "标题" --content-file /tmp/article.md --confirm
+python3 "$Y" create REPO_ID --title "标题" --content-file /tmp/article.md --confirm
 
 # Public publishing additionally requires --public.
-python3 "$SKILL_DIR/scripts/yuque.py" create germey/blog \
-  --title "标题" --content-file /tmp/article.md --public --confirm
-
-python3 "$SKILL_DIR/scripts/yuque.py" update germey/blog DOC_ID \
-  --title "新标题" --content-file /tmp/article.md --public --confirm
+python3 "$Y" create REPO_ID --title "标题" --content-file /tmp/article.md --public --confirm
 ```
 
-`--confirm` is valid only as the final argument. Always show the target
-knowledge base, title, visibility and full content to the user before a public
-publish. Default to a private document unless the user explicitly asks to
-publish publicly.
-
-Note that `update` rewrites the whole document body. Read the current document
-first if the user only wants part of it changed.
+`--confirm` is honored **only as the final argument**. Before a public publish,
+always show the user the target knowledge base, the title, the visibility and
+the full content. Default to private unless they explicitly ask to publish
+publicly.
 
-## Delete
+## Update and delete (token connections only)
 
-```bash
-python3 "$SKILL_DIR/scripts/yuque.py" delete germey/blog DOC_ID --confirm
+```sh
+python3 "$Y" update REPO_NAMESPACE DOC_ID --title "新标题" --content-file /tmp/a.md --confirm
+python3 "$Y" delete REPO_NAMESPACE DOC_ID --confirm
 ```
 
-Use the real returned `doc_id` and URL. Do not retry a timed-out write
-automatically because its outcome may be unknown; list the documents first so
-you do not create a duplicate.
+`update` rewrites the whole document body — read the current document first if
+the user only wants part of it changed.
 
 ## Gotchas
 
+- Use the real returned `doc_id` and `url`; never invent either. A cookie
+  connection cannot always resolve a public URL, in which case `url` is `null`
+  — report the `doc_id` instead of guessing a link.
+- If a write times out its outcome is **unknown** — run `docs` to check before
+  retrying, or you will create a duplicate.
 - Images referenced by external URL are not re-hosted; 语雀 renders them from
-  the original host. If the source blocks hotlinking, upload the images to 语雀
+  the original host. If that host blocks hotlinking, upload the images in 语雀
   manually first and reference the returned URLs.
-- 语雀's own terms state the open API is for normal reading and writing of 语雀
-  content; abnormal automated behaviour can get the account blocked. Keep the
-  volume human-scale.
+- 语雀's terms allow the API for normal reading and writing of 语雀 content;
+  abnormal automated behaviour can get the account blocked. Keep the volume
+  human-scale and never batch-publish.
 
 ## Record the output
 
-After a confirmed public publish returns a real URL, call `publish_artifact`
-once with `kind="article"`, `channel="yuque"`, the title, returned URL, and
-`status="delivered"`. Do not record private documents or failed/unknown writes.
+After a confirmed **public** publish, if the response carries a non-null `url`,
+call `publish_artifact` once with `kind="article"`, `channel="yuque"`, the
+title, that URL, and `status="delivered"`. If `url` is `null`, **do not invent
+one** — report the `doc_id` to the user and skip `publish_artifact`. Do not
+record private documents or failed/unknown writes.