toutiaoAutoPublish

今日头条微头条自动发布工具。自动发布短内容到今日头条平台，支持文本和图片。 使用场景：(1) 用户说"发布头条"、"发微头条"、"头条发布"时触发 (2) 需要自动发布社交媒体内容时 (3) 需要定时发布今日头条时

What to consider before installing/using this skill: - Inconsistent instructions: SKILL.md tells you to start Chrome with --remote-debugging-port=9222, but the script attempts to connect to CDP at http://localhost:18800. Confirm which port the script expects and update either the script or your Chrome startup command. If you run it with 9222 and the script still tries 18800, it will fail to connect. - Default autopost content: The script contains a built-in DEFAULT_CONTENT that will be posted if you do not provide content. That default text claims an AI 'explored' and posted using your account. If you don't want that, edit the script to remove or change DEFAULT_CONTENT or always pass explicit content via the command line or file. - Test on a throwaway account first: Because the script will publish using your logged-in browser session, try it with a test Toutiao account to verify behavior before using any primary account. - Review the rest of the script: The delivered file was partially truncated in the review. Inspect the complete toutiao_publish.py yourself to ensure there are no hidden network calls, webhook URLs, or code that exfiltrates cookies or other data. Pay attention to any page.evaluate(...) JS that might perform XHR/fetch to external hosts. - Local network exposure: The script connects to a local debugging endpoint. Ensure you understand whether any local proxy or service is expected on port 18800; do not expose remote debugging ports to untrusted networks. - Minimal risk mitigations: Run the script in a controlled environment, run it with explicit content, remove or override DEFAULT_CONTENT, and/or run in headless mode with a dedicated browser profile where possible. If you are not comfortable auditing the remainder of the file, avoid using it with any real account. Confidence note: medium — the visible code seems consistent with a publishing tool, but (a) the port mismatch and built-in default post are definite red flags and (b) the file was truncated in the supplied content so I could not fully verify the tail of the script for any external endpoints or additional behavior. If you provide the full script file, I can re-check for any hidden exfiltration or unexpected network calls and raise confidence.

Type: OpenClaw Skill Name: toutiao-auto-publish Version: 1.0.0 The skill is a legitimate automation tool designed to publish content to the Toutiao (今日头条) platform using Playwright. It functions by connecting to a local Chrome instance via remote debugging to leverage existing login sessions. The script (toutiao_publish.py) performs transparent UI automation, including handling image uploads and providing status screenshots on the user's desktop. While it possesses the capability to post on the user's behalf, there is no evidence of data exfiltration, credential theft, or hidden malicious logic. A minor discrepancy exists between the documentation (port 9222) and the code (port 18800), which appears to be a configuration oversight rather than a security risk.