socialdatax-skills 0.2.14 → 0.2.16

package/README.md

@@ -68,7 +68,7 @@ Common search phrases for this skill package:
 - Sensitive Check MCP server name: `sensitive-check`
 - Sensitive Check future MCP registry name: `com.socialdatax/sensitive-check`
 - Unified MCP registry name: none; this package installs skills and calls explicit platform services.
-- Current public capability version: `0.2.14`
+- Current public capability version: `0.2.16`
 
 ## Direct CLI
 
@@ -139,9 +139,10 @@ npx -y socialdatax-skills@latest wechat user-info --user-id "<finder_user_id>" -
 npx -y socialdatax-skills@latest wechat user-posts --user-id "<finder_user_id>" --pretty
 npx -y socialdatax-skills@latest wechat user-posts --url "<wechat_video_url_or_share_text>" --pretty
 npx -y socialdatax-skills@latest sensitive-check text --text "<content>" --platform xhs --pretty
+cat draft.txt | npx -y socialdatax-skills@latest sensitive-check text --text-stdin --platform xhs --pretty
 ```
 
-Most direct CLI commands print a JSON envelope with `platform`, `tool`, `arguments`, and `data`. `sensitive-check` prints `platform`, `tool`, and `data` only; it does not echo the original text in CLI output.
+Most direct CLI commands print a JSON envelope with `platform`, `tool`, `arguments`, and `data`. `sensitive-check` prints `platform`, `tool`, and `data` only; it does not echo the original text in CLI output. SocialDataX service records the submitted text and structured detection result for history, billing, and troubleshooting; the local CLI does not write API keys to local files or write local text copies.
 
 For XHS outputs with a returned `note_url` field, when `note_url` is non-null, preserve it exactly as the full URL, including `xsec_token` query parameters, such as in final answers or display. Do not modify, truncate, redact, normalize, rebuild, or replace it with a link assembled from `note_id`. If `note_url` is null, do not synthesize a public link from `note_id`.
 
@@ -168,8 +169,10 @@ Douyin search filters use semantic values: `--sort-type` supports `general`,
 supports `all`, `video`, and `image`.
 
 WeChat Channels search filters use semantic values: `--sort-type` supports
-`general`, `time_descending`, and `popularity_descending`; `--duration-range`
-supports `all`, `under_5_min`, `between_5_and_20_min`, and `over_20_min`.
+`all`, `time_descending`, and `collect_count_descending`;
+`collect_count_descending` means hottest first / most collected first.
+`--duration-range` supports `all`,
+`under_5_min`, `between_5_and_20_min`, and `over_20_min`.
 
 ### Runtime Requirements
 
@@ -191,7 +194,7 @@ npx -y socialdatax-skills@latest doctor
 npx -y socialdatax-skills@latest doctor --json
 ```
 
-The public package declares no npm lifecycle scripts such as `preinstall`, `install`, or `postinstall`. The installer copies AgentSkills files only, does not save API keys, and does not change MCP server configuration. Authenticated data calls require `SOCIALDATAX_API_KEY` at runtime, do not read local browser data, and do not perform account actions.
+The public package declares no npm lifecycle scripts such as `preinstall`, `install`, or `postinstall`. The installer copies AgentSkills files only, does not write API keys to local files, and does not change MCP server configuration. Authenticated data calls require `SOCIALDATAX_API_KEY` at runtime, do not read local browser data, and do not perform account actions.
 
 ## Platform Names
 
@@ -261,6 +264,7 @@ npx -y socialdatax-skills@latest weibo search --keyword "露营" --pretty
 npx -y socialdatax-skills@latest wechat hot-search --pretty
 npx -y socialdatax-skills@latest wechat search --keyword "露营" --pretty
 npx -y socialdatax-skills@latest sensitive-check text --text "<content>" --platform xhs --pretty
+cat draft.txt | npx -y socialdatax-skills@latest sensitive-check text --text-stdin --platform xhs --pretty
 ```
 
 Available skills:
@@ -357,8 +361,10 @@ Current WeChat Channels / 视频号 workflows include:
 Current Sensitive Check workflows include:
 
 - Check draft text for 敏感检测 / sensitive-content risks before publishing.
+- Pass short drafts with `--text`, or pipe longer/sensitive drafts through `--text-stdin` so the text is not placed directly in the shell command.
 - Choose a platform context with `--platform generic`, `--platform xhs`, `--platform douyin`, or `--platform kuaishou`.
 - Return structured fields such as `violation`, `risk_level`, `types`, `highlights`, `summary`, `platform`, and `suggestions` when available.
+- SocialDataX service records submitted text and structured detection results for history, billing, and troubleshooting; the local CLI does not write API keys to local files or write local text copies.
 - Text checks are read-only. Image sensitive detection is reserved for a future separate tool.
 
 ## XHS Tools
@@ -479,6 +485,7 @@ npx -y socialdatax-skills@latest kuaishou search --keyword "露营" --pretty
 npx -y socialdatax-skills@latest weibo search --keyword "露营" --pretty
 npx -y socialdatax-skills@latest wechat search --keyword "露营" --pretty
 npx -y socialdatax-skills@latest sensitive-check text --text "<content>" --platform xhs --pretty
+cat draft.txt | npx -y socialdatax-skills@latest sensitive-check text --text-stdin --platform xhs --pretty
 ```
 
 MCP client configuration belongs to platform or capability MCP listings. For XHS, use the `xhs-insights` docs; for Douyin, use the `douyin-insights` listing; for Kuaishou, use the `kuaishou-insights` listing; for Weibo, use the `weibo-insights` listing; for WeChat Channels / 视频号, use the `wechat-channels-insights` listing; for 敏感检测, use the `sensitive-check` server.

package/cli.mjs

@@ -7,7 +7,7 @@ import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
 const PACKAGE_NAME = "socialdatax-skills";
-const PACKAGE_VERSION = "0.2.14";
+const PACKAGE_VERSION = "0.2.16";
 const PACKAGE_SPEC = `${PACKAGE_NAME}@latest`;
 const LOG_PREFIX = `[${PACKAGE_NAME}]`;
 const MIN_NODE_VERSION = "20.18.1";
@@ -73,8 +73,14 @@ const BOOLEAN_OPTIONS = new Set([
   "includeReplies",
   "json",
   "pretty",
+  "textStdin",
+]);
+const DIRECT_BOOLEAN_OPTIONS = new Set([
+  "all",
+  "includeReplies",
+  "pretty",
+  "textStdin",
 ]);
-const DIRECT_BOOLEAN_OPTIONS = new Set(["all", "includeReplies", "pretty"]);
 const INSTALL_TARGETS = ["openclaw", "hermes", "agents", "codex", "claude-code", "claude"];
 const VALID_SCOPES = ["user", "workspace", "shared"];
 const XHS_DIRECT_ACTION_OPTIONS = {
@@ -385,9 +391,9 @@ const WECHAT_DIRECT_ACTION_OPTIONS = {
 };
 const WECHAT_DIRECT_ACTION_NAMES = Object.keys(WECHAT_DIRECT_ACTION_OPTIONS).join(", ");
 const WECHAT_SEARCH_SORT_TYPES = [
-  "general",
+  "all",
   "time_descending",
-  "popularity_descending",
+  "collect_count_descending",
 ];
 const WECHAT_SEARCH_DURATION_RANGES = [
   "all",
@@ -413,7 +419,7 @@ const WECHAT_OPTION_DISPLAY_NAMES = {
   userId: "--user-id",
 };
 const SENSITIVE_CHECK_DIRECT_ACTION_OPTIONS = {
-  text: ["text", "platform", "pretty"],
+  text: ["text", "textStdin", "platform", "pretty"],
 };
 const SENSITIVE_CHECK_DIRECT_ACTION_NAMES = Object.keys(
   SENSITIVE_CHECK_DIRECT_ACTION_OPTIONS
@@ -421,6 +427,7 @@ const SENSITIVE_CHECK_DIRECT_ACTION_NAMES = Object.keys(
 const SENSITIVE_CHECK_PLATFORMS = ["generic", "xhs", "douyin", "kuaishou"];
 const SENSITIVE_CHECK_OPTION_DISPLAY_NAMES = {
   text: "--text",
+  textStdin: "--text-stdin",
   platform: "--platform",
 };
 const PLATFORMS = {
@@ -1063,6 +1070,7 @@ function validateSensitiveCheckDirectActionOptions(action, options) {
 
   validateKnownOptions(options, allowedOptions);
   validateFlagOption(options, "pretty", "--pretty");
+  validateFlagOption(options, "textStdin", "--text-stdin");
   for (const key of allowedOptions) {
     if (!DIRECT_BOOLEAN_OPTIONS.has(key)) {
       requireOptionValue(options, key, SENSITIVE_CHECK_OPTION_DISPLAY_NAMES[key]);
@@ -1569,7 +1577,7 @@ function printDoctor(args) {
   console.log("Install safety:");
   console.log("- npm lifecycle scripts: none declared by this package.");
   console.log("- install writes AgentSkills files only.");
-  console.log("- install does not store API keys.");
+  console.log("- install does not write API keys to local files.");
   console.log("- install does not change MCP server configuration.");
   console.log("- install --dry-run previews destinations without writing files.");
   console.log("");
@@ -1868,6 +1876,8 @@ function printHelp() {
   console.log("  --sec-user-id <sec_user_id>");
   console.log("  --text <content>");
   console.log("      Text content for sensitive-check text.");
+  console.log("  --text-stdin");
+  console.log("      Read sensitive-check text from stdin instead of a shell argument.");
   console.log("  --platform <generic|xhs|douyin|kuaishou>");
   console.log("      Target platform for sensitive-check text; default is generic.");
   console.log("  --pages <number>");
@@ -1895,8 +1905,8 @@ function printHelp() {
   console.log("      Douyin content type filter; omit for all content types.");
   console.log("  --page-token <token>");
   console.log("      Continue token-paginated commands with the complete returned next_page_token. For search, omit it on the first request.");
-  console.log("  --sort-type <general|time_descending|popularity_descending>");
-  console.log("      WeChat Channels / 视频号 search sort; omit for default sort.");
+  console.log("  --sort-type <all|time_descending|collect_count_descending>");
+  console.log("      WeChat Channels / 视频号 search sort; collect_count_descending means hottest first / most collected first; omit for default sort.");
   console.log("  --duration-range <all|under_5_min|between_5_and_20_min|over_20_min>");
   console.log("      WeChat Channels / 视频号 duration filter; omit for no duration filter.");
   console.log("  --pretty            Pretty-print direct CLI JSON output.");
@@ -2089,7 +2099,8 @@ async function runSensitiveCheckDirectCommand(args) {
   }
   validateSensitiveCheckDirectActionOptions(action, options);
 
-  const operation = buildSensitiveCheckOperation(action, options);
+  const resolvedOptions = await resolveSensitiveCheckDirectOptions(action, options);
+  const operation = buildSensitiveCheckOperation(action, resolvedOptions);
   const data = await callDirectOperation(operation);
   const envelope = {
     platform: operation.platform.id,
@@ -2100,6 +2111,38 @@ async function runSensitiveCheckDirectCommand(args) {
   process.stdout.write("\n");
 }
 
+async function resolveSensitiveCheckDirectOptions(action, options) {
+  if (action !== "text") {
+    return options;
+  }
+  if (options.text !== undefined && options.textStdin !== undefined) {
+    throw new Error("Use only one of --text or --text-stdin for sensitive-check text.");
+  }
+  if (options.textStdin === undefined) {
+    return options;
+  }
+  const text = await readStdinText();
+  if (!text.trim()) {
+    throw new Error("Missing stdin text for --text-stdin.");
+  }
+  return {
+    ...options,
+    text,
+  };
+}
+
+async function readStdinText() {
+  if (process.stdin.isTTY) {
+    return "";
+  }
+  process.stdin.setEncoding("utf8");
+  let text = "";
+  for await (const chunk of process.stdin) {
+    text += chunk;
+  }
+  return text;
+}
+
 function buildXhsOperation(action, options) {
   switch (action) {
     case "hot-search":
@@ -2857,7 +2900,7 @@ function buildWechatSearchCall(options) {
 }
 
 function buildSensitiveCheckTextCall(options) {
-  if (!options.text) {
+  if (typeof options.text !== "string" || !options.text.trim()) {
     throw new Error("Missing --text for sensitive-check text.");
   }
   const platform = parseAllowedStringOption(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "socialdatax-skills",
-  "version": "0.2.14",
+  "version": "0.2.16",
   "description": "SocialDataX / 社媒数据助手 skill installer and direct CLI helper for hosted platform social media MCP services.",
   "license": "MIT",
   "type": "module",

package/skills/media-comments/SKILL.md

@@ -88,7 +88,7 @@ The command prints JSON with `platform`, `tool`, `arguments`, and `data`. Multi-
 
 ## Safety Boundary
 
-This skill is read-only. It does not read local browser data, does not save API keys, and does not perform login, posting, liking, commenting, or account changes. Prefer the direct CLI; hosted MCP tools are optional when the current agent already supports authenticated streamable HTTP MCP.
+This skill is read-only. It does not read local browser data, does not perform login, posting, liking, commenting, or account changes. The local CLI and installer do not write API keys to local files. Prefer the direct CLI; hosted MCP tools are optional when the current agent already supports authenticated streamable HTTP MCP.
 
 ## MCP Tools
 

package/skills/media-detail/SKILL.md

@@ -73,7 +73,7 @@ The command prints JSON with `platform`, `tool`, `arguments`, and `data`.
 
 ## Safety Boundary
 
-This skill is read-only. It does not read local browser data, does not save API keys, and does not perform login, posting, liking, commenting, or account changes. Prefer the direct CLI; hosted MCP tools are optional when the current agent already supports authenticated streamable HTTP MCP.
+This skill is read-only. It does not read local browser data, does not perform login, posting, liking, commenting, or account changes. The local CLI and installer do not write API keys to local files. Prefer the direct CLI; hosted MCP tools are optional when the current agent already supports authenticated streamable HTTP MCP.
 
 ## MCP Tools
 

package/skills/media-search/SKILL.md

@@ -81,7 +81,7 @@ Optional arguments:
 - Kuaishou `--page-token <next_page_token>`: opaque pagination token; omit it on the first search request. Continue only with the complete returned `next_page_token` from the same search pagination chain. Do not modify, truncate, redact, mask, omit, normalize, rebuild, generate, or replace the middle with ellipses.
 - Weibo `--page-token <next_page_token>`: opaque pagination token; omit it on the first search request. Continue only with the complete returned `next_page_token` from the same search pagination chain. Do not modify, truncate, redact, mask, omit, normalize, rebuild, generate, or replace the middle with ellipses.
 - WeChat Channels / 视频号 `--page-token <next_page_token>`: opaque pagination token; omit it on the first search request. Continue only with the complete returned `next_page_token` from the same search pagination chain. Do not modify, truncate, redact, mask, omit, normalize, rebuild, generate, or replace the middle with ellipses.
-- WeChat Channels / 视频号 `--sort-type <general|time_descending|popularity_descending>`: optional sort value; omit it for the default sort.
+- WeChat Channels / 视频号 `--sort-type <all|time_descending|collect_count_descending>`: optional sort value; omit it for the default sort.
 - WeChat Channels / 视频号 `--duration-range <all|under_5_min|between_5_and_20_min|over_20_min>`: optional duration filter; omit it for no duration filter.
 - Weibo `--pages <n>`: fetch and merge N search pages from the current starting point; continue with returned `next_page_token`.
 - WeChat Channels / 视频号 `--pages <n>`: fetch and merge N search pages from the current starting point; continue with returned `next_page_token`.
@@ -133,9 +133,9 @@ Kuaishou search pagination:
 - Pass the complete returned `next_page_token` back unchanged as `page_token` for the same search pagination chain. Do not modify, truncate, redact, mask, omit, normalize, rebuild, generate, or replace the middle with ellipses.
 
 WeChat Channels / 视频号 sort values:
-- `general`: default sorting.
+- `all`: no sort restriction.
 - `time_descending`: newest first.
-- `popularity_descending`: platform heat first.
+- `collect_count_descending`: hottest first / most collected first.
 
 WeChat Channels / 视频号 duration filter values:
 - `all`: no duration filter.
@@ -149,7 +149,7 @@ Weibo and WeChat Channels search pagination:
 
 ## Safety Boundary
 
-This skill is read-only. It does not read local browser data, does not save API keys, and does not perform login, posting, liking, commenting, or account changes. Prefer the direct CLI; hosted MCP tools are optional when the current agent already supports authenticated streamable HTTP MCP.
+This skill is read-only. It does not read local browser data, does not perform login, posting, liking, commenting, or account changes. The local CLI and installer do not write API keys to local files. Prefer the direct CLI; hosted MCP tools are optional when the current agent already supports authenticated streamable HTTP MCP.
 
 ## MCP Tools
 
@@ -197,7 +197,7 @@ For WeChat Channels / 视频号, call `wechat_search_videos` with:
 - `keyword`: required search phrase or topic.
 - `page_token`: optional opaque pagination token. Continue only with the complete returned `next_page_token` from the same search pagination chain. Do not modify, truncate, redact, mask, omit, normalize, rebuild, generate, or replace the middle with ellipses.
 Do not pass `page` to `wechat_search_videos`; omit `page_token` on the first request.
-- `sort_type`: optional, one of `general`, `time_descending`, `popularity_descending`; omit it for the default sort.
+- `sort_type`: optional, one of `all`, `time_descending`, `collect_count_descending`; omit it for the default sort.
 - `duration_range`: optional duration filter, one of `all`, `under_5_min`, `between_5_and_20_min`, `over_20_min`; omit it for no duration filter.
 Continue WeChat Channels pagination only when `next_page_token` is not empty. Pass the complete returned `next_page_token` back unchanged as `page_token` for the same keyword and filter chain.
 `--since-days` uses CLI-side filtering only and is not an MCP tool argument; for MCP-only calls, request newest-first/native publish-time filters where available and filter returned `publish_time` values in your analysis.

package/skills/media-transcript/SKILL.md

@@ -47,7 +47,7 @@ Submit tools may wait briefly after creating the job. If the transcript is not r
 
 ## Safety Boundary
 
-This skill can submit bounded analysis jobs through hosted MCP tools. It does not read local browser data, does not save API keys, and does not perform login, posting, liking, commenting, or account changes. Use hosted MCP tools only when the current agent already supports authenticated streamable HTTP MCP.
+This skill can submit bounded analysis jobs through hosted MCP tools. It does not read local browser data and does not perform login, posting, liking, commenting, or account changes. The local skill installer does not write API keys to local files. Use hosted MCP tools only when the current agent already supports authenticated streamable HTTP MCP.
 
 ## MCP Tools
 

package/skills/media-user-info/SKILL.md

@@ -76,7 +76,7 @@ The command prints JSON with `platform`, `tool`, `arguments`, and `data`.
 
 ## Safety Boundary
 
-This skill is read-only. It does not read local browser data, does not save API keys, and does not perform login, posting, liking, commenting, or account changes. Prefer the direct CLI; hosted MCP tools are optional when the current agent already supports authenticated streamable HTTP MCP.
+This skill is read-only. It does not read local browser data, does not perform login, posting, liking, commenting, or account changes. The local CLI and installer do not write API keys to local files. Prefer the direct CLI; hosted MCP tools are optional when the current agent already supports authenticated streamable HTTP MCP.
 
 ## MCP Tools
 

package/skills/media-user-posts/SKILL.md

@@ -89,7 +89,7 @@ For recent creator research, prefer CLI `--since-days 30` or another user-specif
 
 ## Safety Boundary
 
-This skill is read-only. It does not read local browser data, does not save API keys, and does not perform login, posting, liking, commenting, or account changes. Prefer the direct CLI; hosted MCP tools are optional when the current agent already supports authenticated streamable HTTP MCP.
+This skill is read-only. It does not read local browser data, does not perform login, posting, liking, commenting, or account changes. The local CLI and installer do not write API keys to local files. Prefer the direct CLI; hosted MCP tools are optional when the current agent already supports authenticated streamable HTTP MCP.
 
 ## MCP Tools
 

package/skills/sensitive-check/SKILL.md

@@ -42,20 +42,24 @@ npx -y socialdatax-skills@latest sensitive-check text --text "<content>" --platf
 
 Required arguments:
 
-- `sensitive-check text --text <content>`: required text to check. Use the user's draft text for analysis, but do not store it in the skill.
+- `sensitive-check text --text <content>` or `sensitive-check text --text-stdin`: required text to check. Use `--text` for short drafts, or pipe longer/sensitive drafts through `--text-stdin` so the text is not placed directly in the shell command.
 
 Optional arguments:
 
+- `--text-stdin`: read text from stdin instead of `--text`; do not pass both.
 - `--platform <generic|xhs|douyin|kuaishou>`: platform context; default is `generic`.
 - `--pretty`: output formatting only.
 
 Use this skill when the user wants 敏感检测, sensitive check, content safety review, or platform-aware preflight review for draft text.
+For longer drafts, prefer `cat draft.txt | npx -y socialdatax-skills@latest sensitive-check text --text-stdin --pretty` so the full text is not placed in shell history.
+Service note: SocialDataX service records the submitted text and structured detection result for history, billing, and troubleshooting; the local CLI does not write API keys to local files or write local text copies.
+服务端会保存提交文本和结构化检测结果，用于历史记录、计费和问题排查；本地 CLI 不会把 API Key 写入本地文件，也不会写本地文本副本。
 The command prints JSON with `platform`, `tool`, and `data`; it does not echo the original text back in CLI arguments. The service returns `violation`, `risk_level`, `types`, `highlights`, `summary`, `platform`, and `suggestions` when available.
 This v1 skill checks text only. Image sensitive detection is intentionally out of scope until a separate image tool is published.
 
 ## Safety Boundary
 
-This skill is read-only. It does not read local browser data, does not save API keys, and does not perform login, posting, liking, commenting, or account changes. Prefer the direct CLI; hosted MCP tools are optional when the current agent already supports authenticated streamable HTTP MCP.
+This skill is read-only. It does not read local browser data, does not perform login, posting, liking, commenting, or account changes. The local CLI and installer do not write API keys to local files. Prefer the direct CLI; hosted MCP tools are optional when the current agent already supports authenticated streamable HTTP MCP.
 
 ## MCP Tools
 

package/skills/socialdatax-content-research-assistant/SKILL.md

@@ -191,7 +191,7 @@ When the user asks for recent content, pass CLI `--since-days <n>` with bounded
 
 ## Safety Boundary
 
-This skill is read-only. It does not read local browser data, does not save API keys, and does not perform login, posting, liking, commenting, or account changes. Prefer the direct CLI; hosted MCP tools are optional when the current agent already supports authenticated streamable HTTP MCP.
+This skill is read-only. It does not read local browser data, does not perform login, posting, liking, commenting, or account changes. The local CLI and installer do not write API keys to local files. Prefer the direct CLI; hosted MCP tools are optional when the current agent already supports authenticated streamable HTTP MCP.
 
 ## MCP Tools