weibo-auto-post

微博自动发布 skill。通过 PIL 生成配图（温暖风/科技感/深夜风/对比卡）→ 剪贴板粘贴图片 → 浏览器自动化发布。触发场景：帮我发微博、发布定时微博、生成微博配图、设置微博定时发布任务。

Things to consider before installing or enabling this skill: - Inconsistencies: SKILL.md tells you to install Playwright, but the code uses pyautogui/pyperclip and PowerShell. Confirm and install only the actual dependencies (Pillow, pyautogui, pyperclip) and remove misleading instructions. - Windows-only assumptions: The scripts and cron examples use Windows paths (C:\Users\..., D:\...) and PowerShell commands but the skill metadata does not restrict OS. Don’t run on non-Windows systems; on Windows, inspect and adapt hardcoded paths to your environment. - Local-file access: The cron guide instructs reading/writing D:\QClaw_workspace\weibo_plan_v2.md and the scripts delete C:\Users\13113\Pictures\weibo_*.png and temp screenshots. If that path is not yours, the script may fail or, if modified, could delete files unexpectedly. Require the skill to use configurable paths instead of hardcoded ones. - GUI automation risks: publish.py uses pyautogui to click/type based on screen coordinates and will control your desktop (including taking screenshots). Run initial tests in a controlled environment (virtual machine or an isolated user session) and avoid enabling scheduled autonomous runs until you’ve verified behavior. - Credentials: The skill relies on an already logged-in browser; it does not request explicit credentials. Be aware that it will act using whatever browser session is active (cookies), so revoke or isolate the account if you do not trust automated posting. - Recommended changes before use: (1) Parameterize all local paths and declare them in metadata; (2) remove or fix the Playwright reference; (3) add OS restriction to Windows if intended; (4) replace hardcoded delete commands with safer cleanup that confirms targets and uses configurable directories; (5) avoid automatic scheduling until you have tested manually. If you are not comfortable auditing or running these scripts locally, do not enable scheduled/autonomous execution and consider running the code only in an isolated VM or test account.

Type: OpenClaw Skill Name: weibo-auto-post Version: 1.0.0 The skill utilizes high-risk capabilities including GUI automation via pyautogui and PowerShell execution via subprocess.run for clipboard manipulation and file deletion. Specifically, scripts/publish.py captures full-screen screenshots and saves them to temporary directories for 'verification,' which poses a significant privacy risk. While the logic appears aligned with the stated goal of automating Weibo posts, the use of hardcoded user-specific paths (e.g., C:\Users\13113\...) and broad desktop control permissions are risky behaviors that could be exploited or repurposed for unauthorized monitoring.