Manage CNBlogs (博客园) articles via MetaWeblog API. Supports save drafts, publish, update, and delete posts.

This skill appears to implement exactly what it claims (CNBlogs MetaWeblog operations), but there are a few issues you should address before installing or running it: 1) Metadata vs. behavior: The skill metadata does not declare required environment variables, but the scripts need CNBLOGS_BLOG_URL, CNBLOGS_USERNAME and CNBLOGS_TOKEN. Treat these as required secrets and do not leave them unset. Prefer the metadata be corrected to list required env vars. 2) Secrets in the repo: tests/test_all.sh includes an exported CNBLOGS_TOKEN-like value and a local path — this may be a leaked credential or a placeholder that looks real. Do not assume that value is safe; remove or rotate any real token embedded in the package before use. 3) TLS verification: The scripts disable SSL verification. This can expose your token and data to man-in-the-middle attacks. Prefer enabling proper certificate verification or only use the scripts against trusted endpoints; modify CustomTransport to use default SSL verification where possible. 4) Hardcoded defaults: Several scripts include default BLOG_URL/USERNAME/blogid values. Make sure you explicitly set your environment variables (do not rely on defaults) so the scripts don't accidentally act against a different account. 5) Token storage best practices: The SKILL.md suggests adding exports to ~/.zshrc; that's convenient but exposes the token to any local process that can read that file. Consider more secure storage (e.g., OS secret store or ephemeral env vars) and avoid committing tokens into dotfiles or the repository. 6) Audit before running: Inspect and, if necessary, remove test files that contain secrets. Run scripts in a controlled environment first, and verify that network endpoints contacted are only your CNBlogs MetaWeblog URL(s). If you need help hardening the scripts (re-enable SSL verification, remove defaults), update them before use.

Type: OpenClaw Skill Name: cnblogs-publisher Version: 1.0.1 The skill bundle provides legitimate functionality for managing CNBlogs articles via the MetaWeblog API, but contains several security vulnerabilities. Multiple scripts (e.g., delete_post.py, save_draft.py, publish.py) explicitly disable SSL certificate verification using ssl._create_unverified_context(), which exposes the user to Man-In-The-Middle (MITM) attacks. Additionally, the test script tests/test_all.sh contains hardcoded credentials, including a MetaWeblog access token and username. While these appear to be developer oversights rather than intentional malice, the lack of input sanitization and weak transport security meet the criteria for a suspicious classification.