← 返回 Skills 市场

内容创作与发布全流程

Name: 内容创作与发布全流程
Author: anbeime

作者 anbeime · GitHub ↗ · v1.0.0

cross-platform ⚠ suspicious

432

总下载

当前安装

版本数

在 OpenClaw 中安装

/install content-creation-publisher

功能描述

content-creation-publisher - 从云端仓库同步的技能

使用说明 (SKILL.md)

\r \r

content-creation-publisher\r

\r 此技能从云端仓库同步。\r \r

来源\r

仓库: https://github.com/anbeime/skill\r
路径: skills/content-creation-publisher/\r \r

状态\r

已下载完整内容\r
已配置环境变量\r
已测试运行\r \r

说明\r

请访问云端仓库获取完整的技能文件和使用说明。\r

安全使用建议

This skill package is incomplete: it only points to a GitHub repo and asks you to get the real files yourself. Before enabling it, inspect the referenced repository (https://github.com/anbeime/skill → skills/content-creation-publisher/) and review any scripts or binaries there. Do not allow the agent to autonomously download-and-execute remote code you haven't reviewed. If you must use it, either (1) vet and fork the repo, then install from your fork, or (2) restrict the agent's ability to run shell/network commands and only provide verified code/artifacts. If you can't review the repo or don't trust the source, avoid installing this skill.

功能分析

Type: OpenClaw Skill Name: content-creation-publisher Version: 1.0.0 The skill is classified as suspicious due to a severe supply chain vulnerability and remote code execution (RCE) risk. The `SKILL.md` file explicitly grants `Bash(*)` permissions to the agent and contains a prompt injection instruction to fetch 'complete skill files' from an external, untrusted GitHub repository (`https://github.com/anbeime/skill`). This design allows for arbitrary code to be downloaded and executed by the agent, creating a direct vector for future malicious payloads without any inherent validation or control within the OpenClaw platform.

能力评估

ℹ Purpose & Capability

The name/description claim a 'sync from cloud repo' capability which matches the SKILL.md reference to a GitHub repository. However, the packaged skill provides no code, no concrete sync implementation, and no declared dependencies — it essentially delegates all action to fetching external repo contents, which is an incomplete packaging choice.

⚠ Instruction Scope

The SKILL.md tells the agent to 'visit the cloud repo to get the full skill files and instructions' and allows Bash. This is vague and grants broad discretion: an agent could download and execute code from that external repo (or run arbitrary network/shell commands) even though no safe constraints, verification steps, or exact commands are provided.

ℹ Install Mechanism

There is no install spec (lowest-risk packaging), but the instructions explicitly point to an external GitHub repo as the source of runtime files. GitHub is a known host (not a shortener or personal IP), but because the skill relies on fetching code that is not bundled or vetted, the effective install mechanism is 'download-and-run' which raises risk unless the repo is inspected first.

✓ Credentials

The skill requests no environment variables, credentials, or config paths. There is no apparent demand for unrelated secrets.

✓ Persistence & Privilege

always is false and there is no indication the skill requests persistent system-wide changes or elevated privileges. It does, however, permit autonomous invocation (the platform default).

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install content-creation-publisher
安装完成后，直接呼叫该 Skill 的名称或使用 /content-creation-publisher 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.0.0

Initial release of content-creation-publisher. - Introduced skill for content publishing, synced from a cloud repository. - Provided repository source link and integration status checklist. - Included instructions to access full files and documentation from the cloud repository.

元数据

Slug content-creation-publisher

版本 1.0.0

许可证 —

累计安装 0

当前安装数 0

历史版本数 1

常见问题