Weibo Manager

Manage Weibo posts via Puppeteer with a secure request-approve-execute workflow for drafting, reviewing, and publishing text and images.

Key things to consider before installing/running this skill: - It contains real executable Node scripts (Puppeteer) but declares no required binaries or env; you will need Node, npm, and a Chrome binary and you should review and install dependencies in a controlled environment. - The skill requires a cookies.json file with Weibo session cookies (sensitive). Do not provide cookies to untrusted code; prefer manual, audited cookie export and storage with least privilege. - The SKILL.md forbids autonomous publishing, but the skill metadata does not enforce that — an agent or other automation could run publisher.js directly. If you must use this, disable autonomous invocation or ensure strict admin approval controls. - The code calls out to other local skills/tools (skills/feishu-sender/* and 'uv run ...') and some scripts reference absolute user paths (e.g. /Users/runchen/...). Audit those called scripts (feishu-sender and nano-banana-ultra) before running — they may transmit data off-host. - Child-process execution is used for notifications and image generation; verify what those subprocesses do and where they send data (Feishu chat IDs are passed around). Ensure Feishu credentials and endpoints are legitimate. - Recommendation: do not run this on a production or personal machine until you: (1) review all referenced files (feishu-sender, nano-banana-ultra scripts), (2) fix hard-coded executablePath and absolute user paths, (3) explicitly provide/lock down cookies.json, (4) document and supply required env creds, and (5) disable autonomous invocation or enforce an approval gate. Running inside an isolated VM or container and monitoring network activity is advised if you still want to test it.

Type: OpenClaw Skill Name: weibo-manager Version: 1.0.2 The OpenClaw AgentSkills skill bundle for Weibo management and image generation contains critical shell injection vulnerabilities. Multiple scripts (`src/approve_post.js`, `src/force_login.js`, `src/login.js`, `src/request_publish.js`) use `child_process.execSync` to execute other internal skills, passing user-controlled inputs (such as `chat_id` and `content`) directly as shell arguments without proper sanitization. This flaw could allow an attacker to achieve Remote Code Execution (RCE) by crafting malicious input. While the `SKILL.md` demonstrates security awareness by explicitly warning against prompt injection from external sources and enforcing an approval workflow, the code itself introduces severe vulnerabilities. There is no evidence of intentional malicious behavior like data exfiltration to external endpoints or persistence mechanisms, but the RCE risk makes it suspicious.