🧊 IceCube 社交账号运营中心 — 管理 X/Twitter、小红书账号的登录、发布、互动全流程。需要 Boss 一次性登录授权后，系统自动运营。当用户提到'账号运营'、'社交账号'、'发布内容'、'Twitter 运营'、'小红书运营'时使用。

What to consider before installing/using this skill: - Understand the big risk: enabling Chrome with --remote-debugging-port lets any local process with access to that port control the browser and read cookies, sessions, and pages. That can leak credentials and private messages for any account logged into that browser profile. - If you proceed, reduce exposure: use a dedicated Chrome profile or a separate browser instance that only has the social accounts you intend to automate; do not keep other personal accounts logged in there. - Prefer safer auth if possible: where supported, use official platform APIs with scoped API keys/tokens (and store those keys in controlled env vars) instead of sharing a whole browser session. The SKILL.md mentions Twitter API as optional — that is preferable when feasible. - Start conservatively: enable 'Boss approval' workflow (make publishing manual or require confirmation for the first N posts) rather than default auto-publish. - Monitor and revoke access: you can stop the skill by closing the Chrome instance with remote debugging or clearing the dedicated profile's cookies. Have a way to quickly revoke access and review logs of what the skill posts and messages it sends. - Verify dependencies: examine the actual implementations (the browser, xiaohongshu-publish, social-media-agent skills) before trusting them — they may request additional credentials or have their own behaviors. - If you want higher assurance: ask the publisher for code or a provenance report. If you cannot review dependent skills or the skill's code, treat this as a potentially high-risk automation and restrict its permissions accordingly. Why I rated this 'suspicious' rather than 'benign': the behavior requested (remote debugging + persistent logged-in browser sessions + autonomous posting and DM handling) is coherent with the stated purpose but grants broad access to potentially unrelated browser accounts and private data; that combination requires explicit user safeguards and more provenance than is provided here. Additional information that would lower risk: an implementation that uses scoped API tokens (not browser debugging), visible code for the dependent skills showing limited scope, or an explicit, enforceable approval flow for each publish.

Type: OpenClaw Skill Name: icecube-social-ops Version: 1.0.0 The skill bundle is a configuration and instruction set for automating social media operations on X/Twitter and Xiaohongshu. It utilizes the 'browser' skill and requires the user to manually enable Chrome remote debugging (port 9222) to facilitate automation without sharing raw credentials. The instructions in SKILL.md are transparent, align with the stated purpose of account management, and do not contain evidence of data exfiltration, unauthorized remote execution, or malicious prompt injection.