SeedDrop

Community engagement assistant that monitors platforms, generates valuable replies referencing your product naturally, and supports approve or auto modes.

What to consider before installing: - Metadata mismatch: The registry entry claimed no required binaries/credentials, but the package and SKILL.md require Node/npx/tsx, a headless browser tool, and a companion SocialVault skill. Do not trust the 'none' metadata — confirm you have the required runtime and companion skill. - Sensitive credentials: The skill requires full session cookies for platforms (e.g., BDUSS, z_c0, d_c0, SESSDATA). Those cookies can be used to act as your account. The skill expects you to store them in SocialVault (encrypted) and to export/inject them into a browser. Only proceed if you fully trust both SocialVault and this skill's code. - Review code and adapters: The package includes many scripts and per-platform adapters. If you are not comfortable auditing them yourself, ask for an independent code review (pay attention to adapters and any network calls they make). Look for hidden remote endpoints, telemetry, or commands that exfiltrate secrets. - Run in a safe environment first: Test with dummy accounts and non-production credentials. Prefer least-privilege credentials and accounts with no payment methods tied. - Validate SocialVault: Confirm the SocialVault skill is the official/expected implementation and understand how it exports credentials to the agent. Verify encryption and access controls. - Manual approval is enforced by the skill, which reduces abuse risk, but manual review only protects the posting step — credential exposure can still occur during monitoring/fallback browser scraping. - If you are uncomfortable granting full session cookies or cannot audit the adapter code, do not install. If you proceed, restrict the skill's access (use test accounts, run in isolated environment, and monitor logs for unexpected network activity).

Type: OpenClaw Skill Name: seed-drop Version: 1.0.4 The SeedDrop skill bundle is a community engagement assistant designed to monitor social platforms (Bilibili, Tieba, Zhihu, Xiaohongshu) and generate reply drafts. The code follows a secure architecture by requiring 'SocialVault' for encrypted credential storage and explicitly disabling autonomous posting in favor of a mandatory manual approval workflow (responder.ts). The use of browser-based fallbacks for anti-detection is consistent with the stated purpose, and the scripts (monitor.ts, scorer.ts, auth-bridge.ts) contain robust safety checks, rate limiting, and deduplication logic without any evidence of data exfiltration or malicious intent.