baijiahao-publisher — 技能工具
v1.0.0基于 OpenClaw 内置浏览器的百家号发布技能。打开发布页、扫码登录、填标题/正文、上传封面图、发布，全自动。零依赖 Python，任意 OpenClaw 环境均可运行。
0· 20·0 当前·0 累计
by 安全扫描
OpenClaw
可疑
high confidenceThe skill's high-level purpose (browser-based Baijiahao publishing) is plausible, but the runtime instructions include hard-coded filesystem paths and an undocumented cookie-injection option that don't match the declared requirements — these mismatches could lead to credential handling or accidental data access.
评估建议
This skill appears to do what it says (automate Baijiahao publishing via the built-in browser), but there are important mismatches you should understand before installing:
- Hard-coded Windows path: The SKILL.md requires copying the cover image to C:\Users\Administrator\AppData\Local\Temp\openclaw\uploads\cover.jpg. If your OpenClaw environment is not Windows or uses a different temp/profile path, the upload step will fail or the agent may attempt to access unexpected locations. Ask the author ...详细分析 ▾
⚠ 用途与能力
The skill claims to be zero-dependency and runnable on any OpenClaw environment, but the SKILL.md hard-codes a Windows-specific upload path (C:\Users\Administrator\AppData\Local\Temp\openclaw\uploads\cover.jpg). The metadata declared no required config paths or credentials, yet the instructions depend on local filesystem write access and the built-in browser capability. This is an incoherence: either the skill should declare that it requires access to that path (and document cross-platform behavior) or avoid hard-coded OS-specific paths.
⚠ 指令范围
Runtime instructions tell the agent to copy user/AI-generated images into a specific local path and then call browser(action="upload") against that path — i.e., the agent will need file system access to arbitrary files. The SKILL.md also documents a 'cookie injection' fallback using document.cookie (browser(action="act"... evaluate ...)), which explicitly directs the agent to set session cookies in the page. Cookie injection is effectively asking for session credentials and is sensitive. These behaviors are outside what the package metadata advertises and broaden the skill's scope (file access + credential handling).
✓ 安装机制
The skill is instruction-only (no install spec, no code files to execute), which reduces risk from arbitrary installs or downloaded code. There are no external URLs or package installs referenced.
⚠ 凭证需求
The registry metadata lists no required environment variables or config paths, yet SKILL.md expects access to a specific filesystem location and suggests optionally injecting cookies (sensitive secrets). Requesting cookie strings or directing users to place files in a privileged path is disproportionate to the declared requirements and should be explicitly declared and justified.
✓ 持久化与权限
The skill is not marked always:true and does not request persistent system-wide changes. It does not appear to modify other skills or global agent settings based on the provided materials.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/16
Major update: browser-based automation added, enabling fully automated Baijiahao publishing across all OpenClaw environments. - Skill renamed from "baijiahao-publisher" to "baijiahao-browser". - Now uses the built-in OpenClaw browser; no Python or Playwright required. - Supports automated: page navigation, QR code login, title/content entry, cover image upload, and article publishing. - Provides detailed and robust workflow steps, including advanced cover image handling and cookie injection options. - Can be invoked by user intent (e.g., "帮我发布百家号文章") with intelligent parameter extraction. - New status codes help clarify publishing results (e.g., success, draft, missing cover).
● 无害
安装命令
点击复制官方npx clawhub@latest install baijiahao-publisher
镜像加速npx clawhub@latest install baijiahao-publisher --registry https://cn.longxiaskill.com 镜像可用