cbismb-harmonyos-publish

ReviewAudited by ClawScan on May 10, 2026.

Overview

This is a straightforward article-publishing helper, but it uses your logged-in browser to post public content and should be used only after reviewing the article and settings.

Use this skill only when you intend to publish to cbismb.com. Before the final Publish action, review the full article text and settings, confirm you are logged into the correct account, and explicitly decide whether to accept the privacy statement or save a draft instead.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Medium

#ASI02: Tool Misuse and Exploitation

What this means

The agent may publish an article visible to others under the user's cbismb.com account.

Why it was flagged

The skill intentionally uses browser actions to submit a public article. This matches the stated purpose, but publishing public content is a high-impact action.

Skill content

本技能用于自动发布文章到中小企业 IT 网 HarmonyOS 开发者社区板块。 ... 点击「发布」按钮

Recommendation

Review the title, body, category, tags, originality, privacy, and comments settings before allowing the final Publish step; ask it to save a draft if unsure.

Low

#ASI03: Identity and Privilege Abuse

What this means

Any publish action will be performed as the currently logged-in cbismb.com user.

Why it was flagged

The workflow relies on the user's existing logged-in browser session and browser relay to perform account actions.

Skill content

- 用户已登录中小企业 IT 网账号
- Chrome 浏览器已附加 OpenClaw Browser Relay 扩展

Recommendation

Confirm the browser is logged into the intended account and avoid using a shared or unintended browser profile.

Low

#ASI09: Human-Agent Trust Exploitation

What this means

The agent could check a privacy-statement box as part of publishing if the user accepts defaults.

Why it was flagged

The skill defaults the privacy-statement checkbox to true. This is disclosed and tied to publishing, but privacy or policy acknowledgements should be explicit.

Skill content

privacy_agreement:
  type: boolean
  description: 是否勾选隐私声明
  default: true ... 根据 `privacy_agreement` (默认: true) 勾选「隐私声明」复选框

Recommendation

Explicitly confirm whether to accept the privacy statement before publishing, especially if the site terms matter for the article.