toutiao-publish

用 Cookie 或已保存会话在头条号后台发布文章，支持标题/正文/图片与固定目录 docx 导入。当用户要自动发头条文章、传入 cookie_header 或要求按 docx 流程发布时调用。

Before installing or using this skill: 1) Confirm you actually have the project at /home/ubuntu/projects/toutiao_poster (or adjust paths) and a working .venv; this skill has no installer. 2) Treat TOUTIAO_COOKIE as a secret: only provide cookies you control and understand that the local script will use them to authenticate; do not paste production account cookies unless you trust the host. 3) Verify and restrict file permissions on the image/docx/artifacts directories — the script will read, upload, and move files there. 4) Ask the publisher for the source code or a homepage and installation instructions so you can audit what the Python module does (network calls, logging, error handling). 5) If you plan to run this in a different environment, update the SKILL.md paths and document required env vars (TOUTIAO_COOKIE, TOUTIAO_IMAGE_DIR) so requirements and metadata match. If you cannot verify the above, avoid providing cookies or running this skill on sensitive accounts.

Type: OpenClaw Skill Name: toutiao-publish-docx Version: 1.0.0 The skill bundle contains a significant shell injection vulnerability in SKILL.md. The instructions guide the AI agent to construct bash commands by directly inserting user-provided strings (such as title, content, and cookie_header) into single-quoted shell arguments. This pattern is highly susceptible to exploitation if the input contains single quotes or other shell metacharacters, potentially allowing arbitrary command execution on the host system. While the stated purpose of automating Toutiao posts is plausible, the insecure command construction poses a high security risk.