Social Publisher

One-click publishing to Juejin, Zhihu, Weibo, and Xiaohongshu with scheduling, format adaptation, and publishing logs using platform cookies.

This skill is not outright malicious, but there are inconsistencies and privacy risks you should weigh before installing: - Do not supply real account cookies until you trust the author. Test with throwaway accounts first. - SKILL.md tells you to put cookies in ~/.openclaw/workspace/config/social-publisher.json, but the script actually reads config/social-publisher.json relative to the skill bundle. Confirm where cookies will be stored and avoid leaving them in a repository or world-readable folder. - The description mentions Xiaohongshu but the script does not implement it — expect incomplete functionality. - Logs are written to memory/social-publish-log.jsonl in the bundle; these may contain publish results and should be protected. - Prefer encrypted/OS-protected credential storage over plaintext cookies in files; if you proceed, review scripts/social_publisher.py yourself (or have someone you trust do so) to verify there are no hidden endpoints or extra network calls. If you cannot verify the code or do not want to risk exposing cookies, do not install or only use test accounts. If you decide to use it, ask the author to fix the config path mismatch, remove/clarify the payment/marketing text, and either implement Xiaohongshu or remove it from the description.

Type: OpenClaw Skill Name: zh-social-publisher Version: 1.0.0 The skill bundle is a social media publishing tool for Juejin, Zhihu, and Weibo. It operates by reading user-provided session cookies from a local configuration file (`social-publisher.json`) and using them to authenticate POST requests to legitimate platform APIs (e.g., `api.juejin.cn`, `www.zhihu.com`, and `api.weibo.cn`). The script (`scripts/social_publisher.py`) uses standard Python libraries and lacks any indicators of data exfiltration to unauthorized endpoints, malicious execution, or prompt injection.