蚁小二

蚁小二支持 50 + 平台一键分发、多账号矩阵管理、团队协作与数据统计，适配图文、短视频等内容，覆盖全平台客户端，助力个人与企业高效运营新媒体矩阵。

This package appears to be a coherent publishing SDK, but exercise caution before installing or using it: 1) The repository/registry metadata does not list the required environment variable (YIXIAOER_API_KEY) even though the code and docs require it—ask the publisher to correct that. 2) The upload action reads local files and uploads them to service-provided pre-signed URLs: avoid passing paths to sensitive files (e.g., ~/.ssh, system configs, databases). 3) Treat YIXIAOER_API_KEY as a high-privilege credential—only provide it if you trust the remote service and the skill source (this package lists no homepage and has unknown source). 4) If possible, run the tool in a restricted environment (container or limited account) or use a service-scoped API key with minimal privileges. 5) Prefer to verify the remote API endpoint (YIXIAOER_API_URL) and examine network interactions, or request provenance (official homepage or maintainer contact) before using in production.

Type: OpenClaw Skill Name: yixiaoer-publish Version: 1.6.0 The skill bundle is a legitimate integration for the YiXiaoEr (蚁小二) social media management platform, designed to facilitate multi-platform content distribution. The core logic in `scripts/api.ts` acts as a transparent wrapper for the official API (yixiaoer.cn), handling authentication via environment variables and providing utility functions for media uploads and account management. While the script has the capability to read local files for uploading purposes, this behavior is explicitly documented and aligned with the tool's stated purpose of publishing media. No evidence of malicious intent, data exfiltration to unauthorized domains, or obfuscation was found.