← 返回 Skills 市场
Naver Blog Publisher
作者
y80163442-boop
· GitHub ↗
· v0.6.1
513
总下载
0
收藏
0
当前安装
9
版本数
在 OpenClaw 中安装
/install naver-blog-writer
功能描述
Publish Naver Blog posts through the ACP marketplace flow (buyer-local thin-runner + sealed payload + offering execute). Use when a user asks to write/publis...
安全使用建议
This skill appears to be a local-publisher that expects a macOS runner and a one-time local Naver login, but the SKILL.md mentions several tokens/config entries that are not declared in the metadata. Before installing: 1) Ask the author for the source or homepage and for an explicit list of required env vars and config file formats. 2) Inspect the npm package @y80163442/naver-thin-runner source or release page — do not run npx blindly. 3) Verify whether the skill will actually require CONTROL_PLANE_URL/ACP_ADMIN_API_KEY (high-privilege) or will keep credentials strictly local. 4) If you must try it, run npx in a sandboxed environment and avoid providing global admin keys; keep user credentials on the local runner only. 5) Prefer a skill that declares its required env vars and provides an auditable install artifact (repository or release) rather than only npx instructions.
功能分析
Type: OpenClaw Skill
Name: naver-blog-writer
Version: 0.6.1
The skill relies on executing an external, scoped npm package (@y80163442/naver-thin-runner) via npx to install a local daemon and system services (--auto-service both) on macOS. It handles sensitive administrative API keys and tokens, and while these actions are consistent with the stated goal of automating Naver Blog publishing, the requirement for broad local system access and the execution of unverified remote code via npx represent a significant security risk.
能力评估
Purpose & Capability
The declared purpose (publish to Naver Blog from a local runner) aligns with the instructions, but the SKILL.md references several control-plane and auth variables (OPENCLAW_OFFERING_EXECUTE_URL, CONTROL_PLANE_URL + ACP_ADMIN_API_KEY, PROOF_TOKEN, SETUP_URL) that are not declared in the skill metadata. That mismatch between declared requirements (none) and runtime needs is concerning.
Instruction Scope
Runtime instructions tell the agent to run npx @y80163442/naver-thin-runner commands, start a local daemon, and auto-load X_LOCAL_TOKEN from ~/.config/naver-thin-runner/config.json. Those steps require reading a local config file and using tokens that are not listed as required env vars, and they suggest the agent will interact with local browser sessions and a local daemon — all sensitive actions beyond simple HTTP API calls.
Install Mechanism
There is no formal install spec; instead the SKILL.md instructs use of npx to run the scoped npm package @y80163442/naver-thin-runner. npx will fetch and execute code from the npm registry at runtime (user-scoped package), which is a moderate-to-high risk vector unless the package and publisher are verified.
Credentials
The skill metadata lists no required env vars, but the docs reference multiple environment/config items (OPENCLAW_OFFERING_ID, SETUP_URL, PROOF_TOKEN, OPENCLAW_OFFERING_EXECUTE_URL, CONTROL_PLANE_URL, ACP_ADMIN_API_KEY, X_LOCAL_TOKEN) and a local config path. Requesting or using unspecified secrets (ACP_ADMIN_API_KEY, X_LOCAL_TOKEN) is disproportionate and unclear.
Persistence & Privilege
The skill is not marked always:true and uses the platform's normal autonomous invocation setting. That alone is not a red flag, but combined with the above issues (local token access and remote package execution) it increases the potential blast radius if the fetched code or runtime steps are malicious.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install naver-blog-writer - 安装完成后，直接呼叫该 Skill 的名称或使用
/naver-blog-writer触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v0.6.1
v0.6.1 of naver-blog-writer
- No code or documentation changes were detected in this version.
- All content, usage notes, and commands remain unchanged from the previous release.
v0.6.0
Version 0.6.0
- Updated usage guidance for first run with a more concise flow summary.
- Clarified production support is macOS only.
- Split and highlighted "Use when" and expanded quick start section for better readability.
- Adjusted flow to run `publish_dry_run` prior to one-time login.
- Added reference to contract and schema docs in Notes.
- Improved formatting and section headings for user clarity.
v0.5.0
Agent-first doctor/dry-run/live publish flow and updated marketplace copy.
v0.4.1
**Summary:** Major documentation and usage update. Now requires all users to use the "Inline Runner" script; standalone tool usage is discouraged.
- Removed old step-by-step tool instructions — ClawHub/ClawPack now exposes only `SKILL.md`.
- Added a single copy-paste "Inline Runner" Bash script that automates full onboarding and blog publish flow.
- Emphasized billing prerequisites and required credentials (SETUP_URL or PROOF_TOKEN + SETUP_ISSUE_URL).
- Clarified required runtime configs and error handling expectations.
- Outdated tool paths (`tools/preflight`, `tools/publish` etc.) are deprecated; direct use of inline code is now mandatory.
v0.4.0
**Improved automation and onboarding for Naver Blog Writer Skill Pack.**
- Added auto token lookup, daemon auto start, and setup/login automation for easier `publish` flow.
- Enhanced error messages with `next_action`, `hint`, and onboarding/billing guidance.
- Updated config to support automatic behaviors (`AUTO_SETUP`, `AUTO_LOGIN_ON_SETUP`, `AUTO_DAEMON_START`, etc).
- Clarified prerequisites for ACP billing and setup, reducing manual steps to a single login.
- Examples and documentation revised for clarity and better user experience.
v0.3.0
Runner SIGTERM fix and ACP flow updates
v0.1.2
Fix preflight invocation to use bash (no executable-bit dependency after install).
v0.1.1
Add ACP marketplace-connected scripts (.sh) and onboarding/publish flow for OpenClaw users.
v0.1.0
Initial ACP-connected skill pack
元数据
常见问题
Naver Blog Publisher 是什么？
Publish Naver Blog posts through the ACP marketplace flow (buyer-local thin-runner + sealed payload + offering execute). Use when a user asks to write/publis... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 513 次。
如何安装 Naver Blog Publisher？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install naver-blog-writer」即可一键安装，无需额外配置。
Naver Blog Publisher 是免费的吗？
是的，Naver Blog Publisher 完全免费（开源免费），可自由下载、安装和使用。
Naver Blog Publisher 支持哪些平台？
Naver Blog Publisher 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 Naver Blog Publisher？
由 y80163442-boop（@y80163442-boop）开发并维护，当前版本 v0.6.1。
推荐 Skills