Multi-Platform Poster

一键发布内容到微信、微博、知乎、小红书和抖音，支持格式自动适配、定时发布及效果数据追踪分析。

This skill appears to be what it says (a cross-posting helper) and legitimately needs platform credentials, but the package metadata does not declare those env vars while the documentation lists them — that's an inconsistency you should resolve before provisioning any secrets. Before installing or binding accounts: 1) Ask the publisher (or ClawHub) where credentials are stored (encrypted in ClawHub UI? sent to external servers?), and whether OAuth token flows are used rather than storing raw secrets. 2) Verify which component actually performs API calls (this skill vs dependent skills) and inspect those implementations or request source/homepage since the skill's source is unknown. 3) Limit privileges: use per-platform test accounts or create API apps with minimal scopes. 4) Confirm data/analytics endpoints and retention policy, and whether any third-party servers receive your content or credentials. If you cannot get clear answers or source code/homepage, treat the skill as higher risk and avoid providing production credentials.

Type: OpenClaw Skill Name: multi-platform-poster Version: 0.1.0 The skill bundle is a legitimate framework for a multi-platform social media posting tool (WeChat, Weibo, etc.). It defines instructions for content adaptation and scheduling but lacks actual implementation code, consisting only of documentation and configuration templates. While it requests various platform API keys (e.g., WECHAT_APP_SECRET in SKILL.md), this behavior is aligned with its stated purpose, and no evidence of malicious intent, data exfiltration, or harmful prompt injection was found.