Weibo Operations

Weibo (微博) write operations via DrissionPage + Chrome CDP. Post, delete, repost, comment, and like on weibo.com. Activate when user asks to publish/delete/re...

This skill automates a locally running Chrome to perform Weibo actions and does that by copying your Chrome profile (Cookies, Login Data, Local Storage, etc.) into /tmp and launching Chrome with remote debugging. Before installing or running it: 1) Understand that copying the profile exposes all browser sessions stored in that profile — use a dedicated / throwaway Chrome profile that contains only the Weibo login if you want to limit exposure. 2) The startup script hardcodes a macOS Chrome path; it will not work as-is on Linux/Windows and the SKILL.md does not mention this. 3) Inspect the included scripts yourself (start_chrome.sh and weibo_ops.py) — they appear to operate locally and do not exfiltrate data, but executing arbitrary scripts that copy your browser profile is sensitive. 4) Because the skill can delete posts, avoid running destructive actions (delete_all) until you test in a safe account. 5) If you cannot verify code or isolate the environment, do not run the script against your main Chrome profile or primary account.

Type: OpenClaw Skill Name: weibo-ops Version: 1.0.0 The skill bundle performs high-risk profile manipulation in `scripts/start_chrome.sh`, copying the user's entire Chrome profile (including `Cookies`, `Login Data`, and `Local Storage`) to `/tmp` to facilitate automation. It also opens a Chrome remote debugging port with `--remote-allow-origins="*"`, which exposes the browser session to potential cross-site attacks. While these actions are technically aligned with the stated goal of Weibo automation via `DrissionPage` in `scripts/weibo_ops.py`, they represent significant security vulnerabilities rather than clear malicious intent, as no external exfiltration logic was identified.