Csdn Publisher

This skill appears to implement CSDN publishing as described, but be cautious before installing or running it: - Metadata omission: The registry metadata declares no required env vars, yet the scripts expect Notion API keys (NOTION_KEY, NOTION_DATABASE_ID), a Telegram config file with bot_token/chat_id, and will write CSDN cookies into ~/.openclaw/workspace/credentials. Ask the publisher to declare these requirements explicitly or do not run until you understand them. - Sensitive artifacts: The skill saves browser storage_state/cookies (session tokens) to your workspace. If compromised, those cookies could let others act as your CSDN account. Store them in a restricted location, use a throwaway/test account where possible, and inspect the cookie file format before sharing. - Headless + noSandbox: The instructions recommend running Chrome with --no-sandbox. That reduces process isolation and increases risk if untrusted pages are opened. Prefer running in a properly sandboxed environment or isolate this skill on a dedicated VM/container. - Network & proxy defaults: Scripts default to a local proxy (http://127.0.0.1:20171). Ensure you understand what that proxy is and control it; otherwise outgoing traffic may be routed unexpectedly. Notion and Telegram calls go to external APIs (api.notion.com, api.telegram.org). - Supply-chain & installs: The skill runs pip/npm installs and downloads Chrome. Review the exact commands and run installs in an isolated environment to reduce supply-chain risk. - Audit the code: Review login.py and inject-content.js — they perform browser automation, CDP connections, and saving of credentials. Ensure you trust these operations and the repository source. If you plan to use Notion deduplication or Telegram notifications, supply those secrets only after reviewing and limiting their scope (use dedicated service tokens with least privilege). - Safer alternatives: If you only want local drafting or manual publishing, avoid enabling the login automation and CDP injection; instead export drafts to markdown and publish manually. If you want to proceed, request that the publisher update package metadata to list all required env vars and data paths, and consider running the skill inside a restricted container with network controls and a dedicated account.