weibo-post

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

A post could be published to the logged-in Weibo account if the agent follows the workflow.

Why it was flagged

The workflow instructs the agent to click the Weibo send button, which is expected for this skill but publishes account content publicly.

Skill content
browser(action=act, profile="openclaw", targetId=<targetId>, ref="e36", kind="click")
Recommendation

Use only when you intentionally want to post, and require a final content/account check before clicking send.

What this means

The skill may post as the Weibo account already logged into the OpenClaw browser profile.

Why it was flagged

Opening Weibo with the named browser profile means the skill will act through whatever Weibo login session is present in that profile.

Skill content
browser(action=navigate, profile="openclaw", url="https://weibo.com")
Recommendation

Before using it, verify the browser profile is logged into the intended Weibo account and avoid sharing that profile with unrelated sessions.