fix: resolve ClawHub suspicious scan for youmind-wechat-article

skills/youmind-wechat-article/.clawhubignore

@@ -1,5 +1,23 @@
+# Dev-only files (not shipped to ClawHub)
 references/environment.md
-toolkit/package-lock.json
-toolkit/node_modules/
+
+# Binary assets (ClawHub only accepts text files, but exclude for clarity)
 image/
 cover/
+
+# Build artifacts and dependencies
+toolkit/node_modules/
+toolkit/dist/
+toolkit/package-lock.json
+
+# Runtime files
+output/
+__pycache__/
+*.pyc
+clients/
+config.yaml
+.env
+
+# Toolkit source (users get pre-built dist via npm install + npm run build)
+toolkit/src/
+toolkit/tsconfig.json

skills/youmind-wechat-article/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: youmind-wechat-article
-version: 1.0.0
+version: 1.0.1
 description: |
   Write and publish WeChat Official Account articles end-to-end with AI — trending topic mining,
   de-AI voice writing, beautiful theme formatting, cover image generation, and one-click draft box publishing.
@@ -53,13 +53,17 @@ metadata:
     primaryEnv: YOUMIND_API_KEY
     requires:
       anyBins: ["node", "npm", "python3"]
-      env: ["YOUMIND_API_KEY"]
 allowed-tools:
-  - Bash(node dist/cli.js *)
-  - Bash(python3 scripts/*)
-  - Bash(npm install)
-  - Bash(npm run build)
-  - Bash([ -n "$YOUMIND_API_KEY" ] *)
+  - Bash(node toolkit/dist/cli.js convert *)
+  - Bash(node toolkit/dist/cli.js publish *)
+  - Bash(node toolkit/dist/cli.js stats *)
+  - Bash(node toolkit/dist/cli.js learn-edits *)
+  - Bash(node toolkit/dist/cli.js build-playbook *)
+  - Bash(python3 scripts/fetch_hotspots.py *)
+  - Bash(python3 scripts/seo_keywords.py *)
+  - Bash(python3 scripts/validate_skill.py *)
+  - Bash(cd toolkit && npm install && npm run build)
+  - Bash(pip install -r requirements.txt)
 ---
 
 # AI WeChat Article Writer — From Topic to Draft Box in One Prompt