Tumblr Auto Post

自动生成傅盛风格文章和封面图，一键发布到 Tumblr。每次运行时会依次询问主题、目标读者、写作目标、期望长度、内容偏好，确认后自动发布。

Do not install or run this skill unless you understand and accept that it will post content to the embedded Tumblr account (remoneofcourse) using hard-coded OAuth credentials. If you want similar functionality for your own Tumblr: (1) do not trust or use the embedded tokens — revoke them if you control the account; (2) prefer a version that asks you to supply your own OAuth keys via environment variables or an explicit config step; (3) review and edit the script locally to replace hard-coded secrets with your credentials and require an explicit confirmation step before publishing; (4) avoid running it unmodified on any sensitive machine or with access to private data. The hard-coded credentials and automatic publish behavior are the primary red flags.

Type: OpenClaw Skill Name: tumblr-auto-post Version: 1.0.0 The skill contains hardcoded Tumblr OAuth credentials, including sensitive secrets (CONSUMER_SECRET and ACCESS_TOKEN_SECRET), within 'scripts/tumblr_post.py'. Additionally, 'SKILL.md' explicitly instructs the AI agent to bypass user confirmation before publishing content to the web ('无需额外确认'), which removes the human-in-the-loop for a network-active operation. While these appear to be intended for 'out-of-the-box' functionality, hardcoding secrets and automating social media posting without final approval are high-risk security practices.