Skip to content
Back to skills

Any2card

ASecurity

Use when authoring an infocard from declared facts or when producing its desktop and mobile visual evidence before release.

  • 2 stars
  • 0 votes
  • 0 copies
  • 0 views
  • Added October 19, 2026
devopspythongoshellbashnodegitapi

Works with

  • api

Security analysis

A100/100

Pro scans all 20 files and shows the line behind each finding

Scanned October 19, 2026

npx -y skills add ccwq/infocard-pub --skill any2card --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Any2card?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Any2card
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/ccwq-any2card/badge)](https://www.skillsdirectory.com/skills/ccwq-any2card)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: any2card
description: Use when authoring an infocard from declared facts or when producing its desktop and mobile visual evidence before release.
version: 3.0.0
---

# Any2Card

## Purpose

The leading word is **evidence**. This skill owns card artifacts and visual evidence. It does not research beyond declared facts, create a worktree, build repository indexes, commit, push, or synchronize Wiki.

Load `infocard-publish-sop/references/infocard-publish-protocol-v3.md` before authoring or reviewing.

## Meta YAML Format Gate (critical — causes silent build failures if violated)

Every card needs a `.meta.yaml` sidecar. The build gate requires `requiredFields = ["slug", "path", "category", "title", "date", "tags", "desc"]`. Violations cause `Index build failed: expected a single document in the stream` or missing-field errors that silently break GitHub Pages deploy.

**Correct format** (slug on line 1, path inside YAML document body):

```yaml
slug: 20260725-xhs-huawei-supply-chain-panic
title: "小红书华为停产舆情调查"
desc: "一句话描述,含来源和日期。"
date: "2026-07-25 00:55:00"
updated: "2026-07-25 00:55:00"
tags:
  - 华为
  - 供应链
category: 舆情调查
author: Hermes Agent
source: 小红书
source_url: https://www.xiaohongshu.com/explore/...
style: hardblue
path: docs/20260725-xhs-huawei-supply-chain-panic.html
```

**Wrong patterns to avoid:**
- `path` before `---` on line 1 (sits outside YAML document → multi-doc error)
- `description` instead of `desc` (legacy, prefer `desc` explicitly)
- Date as bare `2026-07-25` without time component
- Missing `updated` field (required for new/changed cards)
- Missing `category` or `path` fields

## 1. Author declared artifacts

1. Read the Protocol v3 run bundle. Honor its facts, evidence boundaries, asset policy, paths, required visible claims, and required sections.
2. Create only the declared HTML, `.meta.yaml`, and asset manifest. Keep claims attributable and use no undeclared external assets.
3. Write identity, artifact paths, artifact hashes, and content/asset gate results into the bundle.

Completion criterion: every declared artifact exists; required text is visible; every asset complies with the bundle policy; and no artifact falls outside the declared allowlist.

## X-status source workflow

When the primary source is an X (Twitter) status URL, the full extraction pipeline is:

1. **Extract via agent-browser + CDP** (primary, with login state):
   ```bash
   AB=/home/ccwq/.npm/_npx/6de2aa2fded2970c/node_modules/.bin/agent-browser
   NS=x-extract-$(date +%s)
   "$AB" --namespace "$NS" --session "x-extract" \
     --json open "https://x.com/i/status/<STATUS_ID>"
   ```
   Then `Runtime.evaluate` to read article text, author, datetime, engagement stats.

2. **Cross-verify via api.fxtwitter.com** (no login required):
   ```bash
   curl -L --max-time 20 "https://api.fxtwitter.com/status/<STATUS_ID>" -o /tmp/fxtweet.json
   ```
   **Two response shapes** — always check both:
   - **Short-form** (≤ 280 chars): content in `tweet.raw_text.text`
     ```python
     import json
     d = json.load(open('/tmp/fxtweet.json'))
     t = d.get('tweet', {})
     rt = t.get('raw_text') or {}
     print(rt.get('text', ''))  # full post text
     print(t.get('likes'), t.get('retweets'), t.get('views'))
     ```
   - **Long-form article** (X Articles): content in `tweet.article.content.blocks[].text`
     ```python
     art = t.get('article') or {}
     print('title:', art.get('title'))
     for b in (art.get('content') or {}).get('blocks', []):
         tx = b.get('text', '').strip()
         if tx: print(f'[{b.get("type","unstyled")}] {tx}')
     ```
   A post that appears to have no `raw_text` may be a long-form article. Missing this causes silent data loss.

3. **Extract image**: the `media[]` array from fxtwitter or the first `img` in the article DOM. Download with:
   ```bash
   curl -L --fail --silent --show-error --max-time 30 \
     "https://pbs.twimg.com/media/?name=orig" \
     -o assets/img/<slug>/x-post.jpg
   ```

4. **Author card content** — must prominently display:
   - Author display name and `@handle`
   - X status ID and full URL
   - Engagement stats (views, likes, reposts, bookmarks)
   - X-sourced image with source attribution
   - Strict "X 帖子称" vs "已验证事实" distinction for claims

See `references/x-status-content-extraction.md` and `references/x-status-article-preview-guideline.md` for extraction commands and content rules.

## 2. Produce visual evidence

1. Read the repository's actual preview command and route; do not assume a port or path.
2. Start or reuse preview according to repository instructions, then verify the expected identity before review.
3. Inspect desktop `1440×900` and mobile `390×844` independently.
4. If a completed visual result reports `critical` or `major`, record `VISUAL_BLOCKED`. Apply only a targeted authoring repair for a reported issue, then invalidate and replace the prior evidence.
5. If capture infrastructure fails, use `visual-infrastructure-failure.md`. Retry infrastructure only, at most four times after the initial attempt.
6. Write exactly one current disposition to the bundle: `VISUAL_PASSED`, `VISUAL_BLOCKED`, or `VISUAL_PENDING`.

Completion criterion: the bundle contains current evidence for both viewports, a blocking result, or five infrastructure-only failures recorded as pending.

## Boundaries

- Never represent static DOM/CSS checks as visual PASS.
- Do not install dependencies, run repository build/index generation, stage files, commit, push, or write Wiki.
- A card-file change invalidates visual evidence; the publisher must consume the latest bundle disposition only.

## CDP session reuse for visual evidence

Before launching an `agent-browser` session for a local infocard preview, use the workstation Chrome DevTools endpoint supplied by the runtime rather than creating a separate browser session. Preserve unrelated user tabs; create and later close only the preview tab. This is especially important when browser navigation wrappers reject private preview URLs but the attached Chrome can reach them.

**Reliability checks:** a successful `/json/version` response does not prove WebSocket usability. If `agent-browser` reports a `Page.enable` timeout, use a fresh namespace/session instead of the stale default daemon. If the WebSocket handshake returns HTTP 403 mentioning `remote-allow-origins`, repair the runtime browser Origin configuration, then re-probe. Do not claim visual evidence until `tab list`, local-preview `open`, and `get url` all succeed. See `references/agent-browser-runtime-visual-evidence.md`.

**X-source identity gate:** when a supplied X status URL redirects to a canonical profile/status URL or exposes only a shell, preserve the original status ID but do not infer the author from the redirect, profile URL, page title, or search snippets alone. Confirm display name and handle from a rendered post/API payload and record source/confidence in the bundle. If the body is unavailable, mark content pending/blocked and do not author a detailed card from the URL alone. See `infocard-publish-sop/references/x-tweet-content-extraction.md`.

## Upstream: Research → Fact Pack

Before authoring, use `references/primary-research-fact-pack-methodology.md` when the task is a new topic requiring primary-source fact gathering. Also load `references/informal-framework-source-boundaries.md` when the subject is a named technique with a later community-originated classification, quantification, or maturity model (e.g. "L1-L5" levels, "five stages" checklists, or "levels of X"). The framework must be split into: (1) the underlying established concept, and (2) the attribution of the later model, with explicit status (formal / informal / unstandardized).

- A new topic requiring primary-source fact gathering (e.g., "调研 X / 调查 X / 搜集 X 资料")
- An open-source project, framework, or technology needing identity / author / mechanism / license / activity verification
- A subject where structured fact-pack output (✅/🔶/❓ verification tiers, source URL index, narrative angles) serves as upstream input to the three-file pipeline

This file supersedes ad-hoc research patterns and ensures social-media constraints, source-priority ordering, and verification-tier discipline are applied consistently.

## References

- `references/primary-research-fact-pack-methodology.md` — upstream fact-gathering pipeline: source-priority ordering, verification checklist, structured output format, and narrative-angle guidance
- `references/identity-preserving-multiview-card-boundaries.md` — 人物身份保持与多视角生成卡的来源优先级、术语边界、方案分层与验收清单;涉及 GPT Image、Gemini/Nano Banana、InstantID、PuLID 或 3D 脸部重建时先读。
- `references/research-to-infocard-three-file-pattern.md` — three-artifact pipeline (HTML + meta.yaml + wiki.md) for declared fact bundles
- `references/VISUAL_GATE.md` — dual-viewport review record and defect handling
- `infocard-publish-sop/references/infocard-publish-protocol-v3.md` — authoritative status and retry rules
- `infocard-publish-sop/references/visual-infrastructure-failure.md` — use only when screenshot infrastructure fails
- `references/pi-plugins-q-style-asset-manifest-lesson.md` — three-artifact completeness check (HTML + meta.yaml + manifest.json), Q-style hero image routing, manifest schema; always verify all three artifact paths before reporting completion

Files in this skill

  • .gitignore7 B
  • README.md5.4 KB
  • SKILL.md9.4 KB
  • any2card-github-hardblue-workflow/SKILL.md5.2 KB
  • any2card-github-hardblue-workflow/references/grid-3-mobile-fix.md3.6 KB
  • any2card-github-hardblue-workflow/references/publish-integrity.md1.6 KB
  • references/VISUAL_GATE.md1.5 KB
  • references/agent-bridge-section-completeness.md1.4 KB
  • references/agent-browser-runtime-visual-evidence.md2.1 KB
  • references/agent-reach-repo-share-card.md1.5 KB
  • references/agent2-bundle-authoring-and-literal-claims.md2.3 KB
  • references/architecture-overview-flowchart-pattern.md1.1 KB
  • references/bilingual-keyword-copy-pattern.md3 KB
  • references/bilingual-prompt-card-pattern.md2.3 KB
  • references/chinese-first-agent-plugin-card-pattern.md3 KB
  • references/claude-subagents-golden-system.md1.8 KB
  • references/copy-button-component.md4 KB
  • references/css-debugging-browser-tools.md5.9 KB
  • references/design-spec.md21.1 KB
  • references/desktop-border-overlap-vimax-pc-20260609.md2.7 KB

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.