今日头条运营助手

This skill does what its name promises, but it leaves important operational and security details unspecified. Before installing or using it: - Ask the author for source code or a homepage and for a clear list of required credentials, binaries, and install steps. The package currently declares none while the instructions expect account+password and browser automation. - Do not paste account passwords into a skill prompt. Prefer OAuth or session-based auth, or confirm where credentials are stored and whether they are encrypted. - If you allow publishing, require explicit, per-post confirmation and audit logs so the agent cannot publish autonomously without your consent. - Confirm how the skill monitors other platforms (official APIs vs scraping) and ensure that behavior complies with those platforms' terms of service. - Prefer running any browser-automation locally under your control (e.g., with your own browser profile) rather than giving the skill credentials or remote endpoints. - If you cannot verify the source or code, treat the skill as untrusted and avoid providing real account credentials; consider using test accounts only. If you want, I can draft specific questions to send to the skill author to clarify credentials, auth flow, and publishing safeguards.