socialdatax-skills 0.2.15 → 0.2.16

package/README.md

@@ -68,7 +68,7 @@ Common search phrases for this skill package:
 - Sensitive Check MCP server name: `sensitive-check`
 - Sensitive Check future MCP registry name: `com.socialdatax/sensitive-check`
 - Unified MCP registry name: none; this package installs skills and calls explicit platform services.
-- Current public capability version: `0.2.15`
+- Current public capability version: `0.2.16`
 
 ## Direct CLI
 
@@ -139,9 +139,10 @@ npx -y socialdatax-skills@latest wechat user-info --user-id "<finder_user_id>" -
 npx -y socialdatax-skills@latest wechat user-posts --user-id "<finder_user_id>" --pretty
 npx -y socialdatax-skills@latest wechat user-posts --url "<wechat_video_url_or_share_text>" --pretty
 npx -y socialdatax-skills@latest sensitive-check text --text "<content>" --platform xhs --pretty
+cat draft.txt | npx -y socialdatax-skills@latest sensitive-check text --text-stdin --platform xhs --pretty
 ```
 
-Most direct CLI commands print a JSON envelope with `platform`, `tool`, `arguments`, and `data`. `sensitive-check` prints `platform`, `tool`, and `data` only; it does not echo the original text in CLI output.
+Most direct CLI commands print a JSON envelope with `platform`, `tool`, `arguments`, and `data`. `sensitive-check` prints `platform`, `tool`, and `data` only; it does not echo the original text in CLI output. SocialDataX service records the submitted text and structured detection result for history, billing, and troubleshooting; the local CLI does not write API keys to local files or write local text copies.
 
 For XHS outputs with a returned `note_url` field, when `note_url` is non-null, preserve it exactly as the full URL, including `xsec_token` query parameters, such as in final answers or display. Do not modify, truncate, redact, normalize, rebuild, or replace it with a link assembled from `note_id`. If `note_url` is null, do not synthesize a public link from `note_id`.
 
@@ -193,7 +194,7 @@ npx -y socialdatax-skills@latest doctor
 npx -y socialdatax-skills@latest doctor --json
 ```
 
-The public package declares no npm lifecycle scripts such as `preinstall`, `install`, or `postinstall`. The installer copies AgentSkills files only, does not save API keys, and does not change MCP server configuration. Authenticated data calls require `SOCIALDATAX_API_KEY` at runtime, do not read local browser data, and do not perform account actions.
+The public package declares no npm lifecycle scripts such as `preinstall`, `install`, or `postinstall`. The installer copies AgentSkills files only, does not write API keys to local files, and does not change MCP server configuration. Authenticated data calls require `SOCIALDATAX_API_KEY` at runtime, do not read local browser data, and do not perform account actions.
 
 ## Platform Names
 
@@ -263,6 +264,7 @@ npx -y socialdatax-skills@latest weibo search --keyword "露营" --pretty
 npx -y socialdatax-skills@latest wechat hot-search --pretty
 npx -y socialdatax-skills@latest wechat search --keyword "露营" --pretty
 npx -y socialdatax-skills@latest sensitive-check text --text "<content>" --platform xhs --pretty
+cat draft.txt | npx -y socialdatax-skills@latest sensitive-check text --text-stdin --platform xhs --pretty
 ```
 
 Available skills:
@@ -359,8 +361,10 @@ Current WeChat Channels / 视频号 workflows include:
 Current Sensitive Check workflows include:
 
 - Check draft text for 敏感检测 / sensitive-content risks before publishing.
+- Pass short drafts with `--text`, or pipe longer/sensitive drafts through `--text-stdin` so the text is not placed directly in the shell command.
 - Choose a platform context with `--platform generic`, `--platform xhs`, `--platform douyin`, or `--platform kuaishou`.
 - Return structured fields such as `violation`, `risk_level`, `types`, `highlights`, `summary`, `platform`, and `suggestions` when available.
+- SocialDataX service records submitted text and structured detection results for history, billing, and troubleshooting; the local CLI does not write API keys to local files or write local text copies.
 - Text checks are read-only. Image sensitive detection is reserved for a future separate tool.
 
 ## XHS Tools
@@ -481,6 +485,7 @@ npx -y socialdatax-skills@latest kuaishou search --keyword "露营" --pretty
 npx -y socialdatax-skills@latest weibo search --keyword "露营" --pretty
 npx -y socialdatax-skills@latest wechat search --keyword "露营" --pretty
 npx -y socialdatax-skills@latest sensitive-check text --text "<content>" --platform xhs --pretty
+cat draft.txt | npx -y socialdatax-skills@latest sensitive-check text --text-stdin --platform xhs --pretty
 ```
 
 MCP client configuration belongs to platform or capability MCP listings. For XHS, use the `xhs-insights` docs; for Douyin, use the `douyin-insights` listing; for Kuaishou, use the `kuaishou-insights` listing; for Weibo, use the `weibo-insights` listing; for WeChat Channels / 视频号, use the `wechat-channels-insights` listing; for 敏感检测, use the `sensitive-check` server.

package/cli.mjs

@@ -7,7 +7,7 @@ import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
 const PACKAGE_NAME = "socialdatax-skills";
-const PACKAGE_VERSION = "0.2.15";
+const PACKAGE_VERSION = "0.2.16";
 const PACKAGE_SPEC = `${PACKAGE_NAME}@latest`;
 const LOG_PREFIX = `[${PACKAGE_NAME}]`;
 const MIN_NODE_VERSION = "20.18.1";
@@ -73,8 +73,14 @@ const BOOLEAN_OPTIONS = new Set([
   "includeReplies",
   "json",
   "pretty",
+  "textStdin",
+]);
+const DIRECT_BOOLEAN_OPTIONS = new Set([
+  "all",
+  "includeReplies",
+  "pretty",
+  "textStdin",
 ]);
-const DIRECT_BOOLEAN_OPTIONS = new Set(["all", "includeReplies", "pretty"]);
 const INSTALL_TARGETS = ["openclaw", "hermes", "agents", "codex", "claude-code", "claude"];
 const VALID_SCOPES = ["user", "workspace", "shared"];
 const XHS_DIRECT_ACTION_OPTIONS = {
@@ -413,7 +419,7 @@ const WECHAT_OPTION_DISPLAY_NAMES = {
   userId: "--user-id",
 };
 const SENSITIVE_CHECK_DIRECT_ACTION_OPTIONS = {
-  text: ["text", "platform", "pretty"],
+  text: ["text", "textStdin", "platform", "pretty"],
 };
 const SENSITIVE_CHECK_DIRECT_ACTION_NAMES = Object.keys(
   SENSITIVE_CHECK_DIRECT_ACTION_OPTIONS
@@ -421,6 +427,7 @@ const SENSITIVE_CHECK_DIRECT_ACTION_NAMES = Object.keys(
 const SENSITIVE_CHECK_PLATFORMS = ["generic", "xhs", "douyin", "kuaishou"];
 const SENSITIVE_CHECK_OPTION_DISPLAY_NAMES = {
   text: "--text",
+  textStdin: "--text-stdin",
   platform: "--platform",
 };
 const PLATFORMS = {
@@ -1063,6 +1070,7 @@ function validateSensitiveCheckDirectActionOptions(action, options) {
 
   validateKnownOptions(options, allowedOptions);
   validateFlagOption(options, "pretty", "--pretty");
+  validateFlagOption(options, "textStdin", "--text-stdin");
   for (const key of allowedOptions) {
     if (!DIRECT_BOOLEAN_OPTIONS.has(key)) {
       requireOptionValue(options, key, SENSITIVE_CHECK_OPTION_DISPLAY_NAMES[key]);
@@ -1569,7 +1577,7 @@ function printDoctor(args) {
   console.log("Install safety:");
   console.log("- npm lifecycle scripts: none declared by this package.");
   console.log("- install writes AgentSkills files only.");
-  console.log("- install does not store API keys.");
+  console.log("- install does not write API keys to local files.");
   console.log("- install does not change MCP server configuration.");
   console.log("- install --dry-run previews destinations without writing files.");
   console.log("");
@@ -1868,6 +1876,8 @@ function printHelp() {
   console.log("  --sec-user-id <sec_user_id>");
   console.log("  --text <content>");
   console.log("      Text content for sensitive-check text.");
+  console.log("  --text-stdin");
+  console.log("      Read sensitive-check text from stdin instead of a shell argument.");
   console.log("  --platform <generic|xhs|douyin|kuaishou>");
   console.log("      Target platform for sensitive-check text; default is generic.");
   console.log("  --pages <number>");
@@ -2089,7 +2099,8 @@ async function runSensitiveCheckDirectCommand(args) {
   }
   validateSensitiveCheckDirectActionOptions(action, options);
 
-  const operation = buildSensitiveCheckOperation(action, options);
+  const resolvedOptions = await resolveSensitiveCheckDirectOptions(action, options);
+  const operation = buildSensitiveCheckOperation(action, resolvedOptions);
   const data = await callDirectOperation(operation);
   const envelope = {
     platform: operation.platform.id,
@@ -2100,6 +2111,38 @@ async function runSensitiveCheckDirectCommand(args) {
   process.stdout.write("\n");
 }
 
+async function resolveSensitiveCheckDirectOptions(action, options) {
+  if (action !== "text") {
+    return options;
+  }
+  if (options.text !== undefined && options.textStdin !== undefined) {
+    throw new Error("Use only one of --text or --text-stdin for sensitive-check text.");
+  }
+  if (options.textStdin === undefined) {
+    return options;
+  }
+  const text = await readStdinText();
+  if (!text.trim()) {
+    throw new Error("Missing stdin text for --text-stdin.");
+  }
+  return {
+    ...options,
+    text,
+  };
+}
+
+async function readStdinText() {
+  if (process.stdin.isTTY) {
+    return "";
+  }
+  process.stdin.setEncoding("utf8");
+  let text = "";
+  for await (const chunk of process.stdin) {
+    text += chunk;
+  }
+  return text;
+}
+
 function buildXhsOperation(action, options) {
   switch (action) {
     case "hot-search":
@@ -2857,7 +2900,7 @@ function buildWechatSearchCall(options) {
 }
 
 function buildSensitiveCheckTextCall(options) {
-  if (!options.text) {
+  if (typeof options.text !== "string" || !options.text.trim()) {
     throw new Error("Missing --text for sensitive-check text.");
   }
   const platform = parseAllowedStringOption(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "socialdatax-skills",
-  "version": "0.2.15",
+  "version": "0.2.16",
   "description": "SocialDataX / 社媒数据助手 skill installer and direct CLI helper for hosted platform social media MCP services.",
   "license": "MIT",
   "type": "module",

package/skills/media-comments/SKILL.md

@@ -88,7 +88,7 @@ The command prints JSON with `platform`, `tool`, `arguments`, and `data`. Multi-
 
 ## Safety Boundary
 
-This skill is read-only. It does not read local browser data, does not save API keys, and does not perform login, posting, liking, commenting, or account changes. Prefer the direct CLI; hosted MCP tools are optional when the current agent already supports authenticated streamable HTTP MCP.
+This skill is read-only. It does not read local browser data, does not perform login, posting, liking, commenting, or account changes. The local CLI and installer do not write API keys to local files. Prefer the direct CLI; hosted MCP tools are optional when the current agent already supports authenticated streamable HTTP MCP.
 
 ## MCP Tools
 

package/skills/media-detail/SKILL.md

@@ -73,7 +73,7 @@ The command prints JSON with `platform`, `tool`, `arguments`, and `data`.
 
 ## Safety Boundary
 
-This skill is read-only. It does not read local browser data, does not save API keys, and does not perform login, posting, liking, commenting, or account changes. Prefer the direct CLI; hosted MCP tools are optional when the current agent already supports authenticated streamable HTTP MCP.
+This skill is read-only. It does not read local browser data, does not perform login, posting, liking, commenting, or account changes. The local CLI and installer do not write API keys to local files. Prefer the direct CLI; hosted MCP tools are optional when the current agent already supports authenticated streamable HTTP MCP.
 
 ## MCP Tools
 

package/skills/media-search/SKILL.md

@@ -149,7 +149,7 @@ Weibo and WeChat Channels search pagination:
 
 ## Safety Boundary
 
-This skill is read-only. It does not read local browser data, does not save API keys, and does not perform login, posting, liking, commenting, or account changes. Prefer the direct CLI; hosted MCP tools are optional when the current agent already supports authenticated streamable HTTP MCP.
+This skill is read-only. It does not read local browser data, does not perform login, posting, liking, commenting, or account changes. The local CLI and installer do not write API keys to local files. Prefer the direct CLI; hosted MCP tools are optional when the current agent already supports authenticated streamable HTTP MCP.
 
 ## MCP Tools
 

package/skills/media-transcript/SKILL.md

@@ -47,7 +47,7 @@ Submit tools may wait briefly after creating the job. If the transcript is not r
 
 ## Safety Boundary
 
-This skill can submit bounded analysis jobs through hosted MCP tools. It does not read local browser data, does not save API keys, and does not perform login, posting, liking, commenting, or account changes. Use hosted MCP tools only when the current agent already supports authenticated streamable HTTP MCP.
+This skill can submit bounded analysis jobs through hosted MCP tools. It does not read local browser data and does not perform login, posting, liking, commenting, or account changes. The local skill installer does not write API keys to local files. Use hosted MCP tools only when the current agent already supports authenticated streamable HTTP MCP.
 
 ## MCP Tools
 

package/skills/media-user-info/SKILL.md

@@ -76,7 +76,7 @@ The command prints JSON with `platform`, `tool`, `arguments`, and `data`.
 
 ## Safety Boundary
 
-This skill is read-only. It does not read local browser data, does not save API keys, and does not perform login, posting, liking, commenting, or account changes. Prefer the direct CLI; hosted MCP tools are optional when the current agent already supports authenticated streamable HTTP MCP.
+This skill is read-only. It does not read local browser data, does not perform login, posting, liking, commenting, or account changes. The local CLI and installer do not write API keys to local files. Prefer the direct CLI; hosted MCP tools are optional when the current agent already supports authenticated streamable HTTP MCP.
 
 ## MCP Tools
 

package/skills/media-user-posts/SKILL.md

@@ -89,7 +89,7 @@ For recent creator research, prefer CLI `--since-days 30` or another user-specif
 
 ## Safety Boundary
 
-This skill is read-only. It does not read local browser data, does not save API keys, and does not perform login, posting, liking, commenting, or account changes. Prefer the direct CLI; hosted MCP tools are optional when the current agent already supports authenticated streamable HTTP MCP.
+This skill is read-only. It does not read local browser data, does not perform login, posting, liking, commenting, or account changes. The local CLI and installer do not write API keys to local files. Prefer the direct CLI; hosted MCP tools are optional when the current agent already supports authenticated streamable HTTP MCP.
 
 ## MCP Tools
 

package/skills/sensitive-check/SKILL.md

@@ -42,20 +42,24 @@ npx -y socialdatax-skills@latest sensitive-check text --text "<content>" --platf
 
 Required arguments:
 
-- `sensitive-check text --text <content>`: required text to check. Use the user's draft text for analysis, but do not store it in the skill.
+- `sensitive-check text --text <content>` or `sensitive-check text --text-stdin`: required text to check. Use `--text` for short drafts, or pipe longer/sensitive drafts through `--text-stdin` so the text is not placed directly in the shell command.
 
 Optional arguments:
 
+- `--text-stdin`: read text from stdin instead of `--text`; do not pass both.
 - `--platform <generic|xhs|douyin|kuaishou>`: platform context; default is `generic`.
 - `--pretty`: output formatting only.
 
 Use this skill when the user wants 敏感检测, sensitive check, content safety review, or platform-aware preflight review for draft text.
+For longer drafts, prefer `cat draft.txt | npx -y socialdatax-skills@latest sensitive-check text --text-stdin --pretty` so the full text is not placed in shell history.
+Service note: SocialDataX service records the submitted text and structured detection result for history, billing, and troubleshooting; the local CLI does not write API keys to local files or write local text copies.
+服务端会保存提交文本和结构化检测结果，用于历史记录、计费和问题排查；本地 CLI 不会把 API Key 写入本地文件，也不会写本地文本副本。
 The command prints JSON with `platform`, `tool`, and `data`; it does not echo the original text back in CLI arguments. The service returns `violation`, `risk_level`, `types`, `highlights`, `summary`, `platform`, and `suggestions` when available.
 This v1 skill checks text only. Image sensitive detection is intentionally out of scope until a separate image tool is published.
 
 ## Safety Boundary
 
-This skill is read-only. It does not read local browser data, does not save API keys, and does not perform login, posting, liking, commenting, or account changes. Prefer the direct CLI; hosted MCP tools are optional when the current agent already supports authenticated streamable HTTP MCP.
+This skill is read-only. It does not read local browser data, does not perform login, posting, liking, commenting, or account changes. The local CLI and installer do not write API keys to local files. Prefer the direct CLI; hosted MCP tools are optional when the current agent already supports authenticated streamable HTTP MCP.
 
 ## MCP Tools
 

package/skills/socialdatax-content-research-assistant/SKILL.md

@@ -191,7 +191,7 @@ When the user asks for recent content, pass CLI `--since-days <n>` with bounded
 
 ## Safety Boundary
 
-This skill is read-only. It does not read local browser data, does not save API keys, and does not perform login, posting, liking, commenting, or account changes. Prefer the direct CLI; hosted MCP tools are optional when the current agent already supports authenticated streamable HTTP MCP.
+This skill is read-only. It does not read local browser data, does not perform login, posting, liking, commenting, or account changes. The local CLI and installer do not write API keys to local files. Prefer the direct CLI; hosted MCP tools are optional when the current agent already supports authenticated streamable HTTP MCP.
 
 ## MCP Tools