Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Clawhub Skill Toutiao Publisher

v2.0.0

自动发布图文文章和微头条到头条号,支持选题、写文、配图生成、Cookie登录、图文混排发布的全自动流程,也可定时自动化执行。

0· 115·0 current·0 all-time
bykevin.l@kevin1220

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for kevin1220/kevin-toutiao-auto-publisher.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Clawhub Skill Toutiao Publisher" (kevin1220/kevin-toutiao-auto-publisher) from ClawHub.
Skill page: https://clawhub.ai/kevin1220/kevin-toutiao-auto-publisher
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install kevin-toutiao-auto-publisher

ClawHub CLI

Package manager switcher

npx clawhub@latest install kevin-toutiao-auto-publisher
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
Name/description (自动发布到头条号) matches the code and instructions: Playwright automation, article/image generation, cookie-based login, and optional Feishu notifications. Declared requirements (Python, Playwright, Chrome) and requirements.txt align with the stated functionality. No unrelated credentials or external services are requested beyond the optional Feishu notifier and the target platform (mp.toutiao.com).
Instruction Scope
SKILL.md and scripts instruct the agent to read a local config file and a local Cookie JSON and to drive a browser via Playwright to perform login/publish actions. This scope is consistent with the purpose, but it explicitly requires access to sensitive account cookies and will read/write local files (cookie JSON, logs, generated-images). The docs also mention connecting to an existing Chrome CDP (port 9222) while most provided code launches Playwright-managed browsers — a minor inconsistency but not malicious.
Install Mechanism
No remote download/install spec is included; code is bundled and dependencies are declared in requirements.txt (playwright, requests, schedule, Pillow). That is proportionate to the functionality. There are no URLs or archive extracts that would write arbitrary remote code to disk during installation.
Credentials
The skill does not request environment variables, but it requires a local cookie JSON (full session cookies for the Toutiao account) and optionally Feishu app_id/app_secret in config. These are sensitive but appropriate for a tool that automates authenticated publishing and sends notifications. Users should be aware that providing the cookie file gives the code effective full account access. The skill can save/refresh cookies to the provided cookie path.
Persistence & Privilege
always:false and standard autonomous invocation are used. The skill stores artifacts under its project directories (logs, generated-images) and may write the cookie file if refresh_cookies() is called — confined to the provided cookie path. It does not request system-wide privileges nor modifies other skills' configs.
Assessment
This package appears to do what it says: automate writing/generating images and posting to a Toutiao account via Playwright. Before installing: (1) Understand that you must supply your account cookie JSON — anyone with that file can access and act as your account; use a dedicated account if possible and keep the cookie file local and out of version control. (2) Feishu credentials are optional but if provided are stored in a local config file — treat them as secrets. (3) Review the code (scripts and cookie_manager.save_cookies) if you want to ensure cookies aren't overwritten or exfiltrated; run in an isolated environment (container/VM) if you have concerns. (4) Be aware automated posting may violate platform terms; configure rate/scheduling conservatively. If you want a higher-assurance review, provide the truncated lines around any remaining truncated functions (the one truncated article title function and any omitted file) so those can be inspected for hidden network calls or obfuscation.

Like a lobster shell, security has layers — review code before you run it.

latestvk979khjf61vj7w0ega18vq18gh83w193
115downloads
0stars
2versions
Updated 4w ago
v2.0.0
MIT-0

头条全自动发布 Skill

全自动发布图文文章和微头条到头条号的 AI Agent Skill。

功能特性

  • 图文文章发布:从选题 → 写文 → 配图 → 发布的完整流程
  • 微头条发布:快速发布短内容(~200字)到微头条
  • 配图生成:自动生成水墨中国风配图(支持自定义风格)
  • Cookie 登录:通过 Cookie 注入实现免验证码登录
  • 图文混排:正文与配图混排,排版美观
  • 飞书通知:发布成功/失败后自动推送通知
  • 定时自动化:支持每小时自动发布(可配置时间段)
  • 热门话题获取:自动从话题邀请中筛选围观最多的话题

前置条件

  1. 已有头条号(mp.toutiao.com)
  2. 已安装 Python 3.8+ 和 Playwright
  3. Chrome 浏览器已安装
  4. 已获取头条号的 Cookie(JSON 格式)

快速开始

第一步:配置账号

复制 config/account_config.json.exampleconfig/account_config.json,填入你的信息:

{
  "account_id": "你的头条账号ID",
  "account_name": "你的头条号名称",
  "cookie_file": "/path/to/toutiao_cookies.json",
  "inject_script": "/path/to/inject_cookies.sh",
  "feishu_config": {
    "app_id": "可选,飞书机器人APP_ID",
    "app_secret": "可选,飞书机器人APP_SECRET",
    "open_id": "可选,飞书通知接收人OPEN_ID"
  }
}

第二步:获取 Cookie

  1. 用 Chrome 打开 https://mp.toutiao.com 并登录
  2. 按 F12 → Application → Cookies → 复制所有 Cookie 到 JSON 文件
  3. Cookie 有效期约 30 天,过期需重新获取

第三步:安装依赖

pip install playwright
playwright install chromium
pip install -r requirements.txt

使用方法

方式一:AI Agent 自动执行(推荐)

安装此 Skill 后,直接用自然语言指示 Agent:

  • "帮我发布一篇关于「中年焦虑」的头条文章"
  • "写一篇微头条,主题是职场困境,200字"
  • "生成一张水墨中国风的配图"
  • "设置每天 6 点到 23 点每小时自动发微头条"

Agent 会自动完成:选题 → 内容生成 → 配图生成 → Cookie 注入 → 发布 → 通知

方式二:脚本调用

# 发布图文文章
python3 scripts/publish_article.py
python3 scripts/publish_article.py --topic "中年困境"
python3 scripts/publish_article.py --no-publish  # 只生成不发布

# 发布微头条
python3 scripts/publish_weitoutiao.py
python3 scripts/publish_weitoutiao.py --content "你的内容"
python3 scripts/publish_weitoutiao.py --auto-topic  # 自动选题

# 定时自动化
python3 scripts/run_scheduler.py --type article
python3 scripts/run_scheduler.py --type weitoutiao
python3 scripts/run_scheduler.py --type both

工作流程

图文文章发布

选题/指定话题 → 生成文章内容 → 生成1张水墨风配图
→ Cookie注入登录 → 导航到发布页 → 填写标题 → 填写正文
→ 插入配图到正文 → 设置封面 → 勾选声明 → 发布 → 通知

发布 URLhttps://mp.toutiao.com/profile_v4/graphic/publish

关键步骤

  1. 通过 Playwright CDP 连接已有 Chrome(端口 9222)
  2. Cookie 注入后导航到发布页
  3. 标题用 JS 原生 setter + 事件触发(避免 ProseMirror 拦截)
  4. 正文用 insertHTML 一次性插入段落
  5. 配图通过工具栏图片按钮 → file input 上传
  6. 封面选择"单图"模式上传
  7. 勾选"个人观点,仅供参考"声明
  8. 点击"预览并发布" → "确认发布"

微头条发布

获取热门话题 → 生成短内容(~200字) → 生成配图
→ Cookie注入登录 → 导航到微头条发布页 → 填写内容
→ 上传配图 → 发布 → 通知

发布 URLhttps://mp.toutiao.com/profile_v4/weitoutiao/publish

配置说明

account_config.json

字段必填说明
account_id头条账号 ID
account_name头条号名称
cookie_fileCookie JSON 文件路径
inject_scriptCookie 注入脚本路径
feishu_config飞书通知配置

automation_settings.json

{
  "article": {
    "enabled": true,
    "schedule": "0 * 6-23 * * *",
    "max_retries": 3,
    "timeout": 300
  },
  "weitoutiao": {
    "enabled": true,
    "schedule": "0 * 6-23 * * *",
    "auto_select_topic": true,
    "timeout": 180
  }
}

核心模块 API

PlaywrightPublisher(浏览器自动化发布引擎)

from core.playwright_publisher import PlaywrightPublisher

pub = PlaywrightPublisher(headless=False, account_name="你的账号名")
await pub.start()                          # 启动 CDP 连接
await pub.load_cookies("/path/to/cookies.json")  # 注入 Cookie
await pub.navigate_to_publish()            # 导航到发布页
await pub.fill_title("文章标题")            # 填写标题
await pub.fill_content("文章正文")          # 填写正文
await pub.insert_image("/path/to/img.png")  # 插入正文配图
await pub.upload_cover_image("/path/to/img.png")  # 设置封面
await pub.check_declarations()             # 勾选声明
success = await pub.publish()              # 发布

PublisherManager(API 方式发布)

from core.publisher import PublisherManager

pub = PublisherManager(config_file="config/account_config.json")

# 图文发布
result = await pub.publish_article(
    title="标题", content="内容",
    images=["/path/to/img1.png"],
    options={"personal_view": True}
)

# 微头条发布
result = await pub.publish_weitoutiao(
    content="微头条内容", image="/path/to/img.png"
)

# 获取热门话题
topics = await pub.get_topic_invitations()
topic = pub.get_hot_topic(topics)  # 围观最多的话题

配图生成

支持通过 AI 工具自动生成水墨中国风配图:

# 推荐提示词模板
prompt = "水墨中国风画,竹子,宣纸底色,红色印章,极简留白"
size = "1024x1024"

风格关键词:竹子、宣纸、红色印章、极简、留白、山水、松树

故障排查

问题原因解决方案
发布失败,提示重新登录Cookie 过期重新获取 Cookie(有效期约30天)
封面上传失败DOM 选择器变化查看 logs/ 目录截图调试
配图生成失败AI 服务不可用检查网络或换时段重试
预览对话框未弹出页面加载慢增加等待时间或检查截图
定时任务不执行schedule 配置错误检查 automation_settings.json
AI 助手抽屉遮挡操作头条 SPA 的 AI 浮层自动用 JS 隐藏所有 drawer

项目结构

toutiao-publisher/
├── SKILL.md                          # 本文件(ClawHub 标准格式)
├── README.md                         # 详细文档
├── requirements.txt                  # Python 依赖
├── config/
│   ├── account_config.json.example   # 账号配置模板
│   └── automation_settings.json      # 自动化设置
├── core/
│   ├── playwright_publisher.py       # Playwright 自动化发布引擎
│   ├── publisher.py                  # API 方式发布器
│   ├── article_generator.py          # 文章内容生成
│   ├── image_generator.py            # 配图生成
│   ├── cookie_manager.py             # Cookie 管理
│   └── notifier.py                   # 通知系统
├── scripts/
│   ├── publish_article.py            # 图文发布脚本
│   ├── publish_weitoutiao.py         # 微头条发布脚本
│   └── run_scheduler.py              # 定时任务脚本
├── templates/
│   ├── article_prompts/              # 文章生成提示词
│   └── weitoutiao_prompts/           # 微头条提示词
└── logs/                             # 日志目录

安全建议

  • 不要将 Cookie 文件或包含密钥的配置文件上传到公开仓库
  • 使用 .gitignore 忽略 config/account_config.json
  • 定期更新 Cookie(有效期约 30 天)
  • 遵守头条平台规则,避免违规操作

许可证

MIT License - 欢迎自由使用和修改

变更日志

v2.0.0 - 包含实际可执行代码

  • 新增完整 Python 核心代码(core/ 目录)
  • 所有硬编码个人信息替换为配置变量(从 config/account_config.json 读取)
  • 新增 publish_article.py / publish_weitoutiao.py / run_scheduler.py 脚本
  • 支持命令行参数调用
  • 支持自定义个人画像(ArticleGenerator 支持传入 personal_profile)
  • 新增 .gitignore 保护敏感配置

v1.0.0 - 初始发布

  • 文档和配置模板

版本

v2.0.0 - 包含完整代码,通用化配置,可直接使用

Comments

Loading comments...