Multi-Platform Publisher

Publish content to X/Twitter, LinkedIn, WeChat Official Account, and Xiaohongshu with one command. Automatically adapts content format for each platform — th...

This skill appears to implement the advertised multi-platform publisher, but pay attention to the following before installing or using it: - The CLI and code require multiple sensitive credentials (Twitter API key/secret + token/secret, LinkedIn access token, WeChat appid/appsecret, and a Xiaohongshu browser cookie). The registry metadata incorrectly lists no required env vars — assume you must provide those secrets to use the skill. - Xiaohongshu behavior: the adapter can delegate to an MCP server (default http://localhost:3001) or call XHS web APIs directly. If you (or your openclaw.json) set XHS_MCP_ENDPOINT to a remote host, the skill will send your content and base64-encoded images to that host. Only point it to a trusted, local MCP server; do not use an untrusted remote endpoint for the MCP setting. - Sensitive storage: avoid placing long-lived credentials or cookies in shared/nebulous config files. If you must store credentials, use least-privilege tokens and a dedicated account when possible. - Review and test in an isolated environment first: run the tool with --dry-run, validate credentials with the validate command, and inspect network traffic (or run in a sandbox) before giving it access to production accounts. - If you plan to use Twitter/LinkedIn/WeChat, prefer short-lived OAuth tokens or accounts with limited permissions where possible. Consider auditing/locking the ~/.openclaw/openclaw.json entry to ensure it contains only expected keys for this skill. Given the metadata mismatch and the MCP delegation risk, treat this skill as potentially privacy-risky until you confirm the MCP endpoint and credential handling meet your security requirements.

Type: OpenClaw Skill Name: multi-platform-publisher Version: 1.0.0 The multi-platform-publisher skill is a legitimate tool designed to automate content posting across X/Twitter, LinkedIn, WeChat, and Xiaohongshu. The code follows standard practices for API integration, including OAuth 1.0a signing for Twitter (twitter_adapter.py) and credential management via environment variables or configuration files (config_loader.py). No evidence of data exfiltration, malicious execution, or prompt injection was found; all network requests are directed to the official API endpoints of the supported platforms.