Juejin Geo Draft Generator

PassAudited by ClawScan on May 13, 2026.

Overview

This skill appears to be a benign draft-generation helper, with disclosed visible browser automation and manual review before any Juejin publication.

This skill is reasonable to install if you want a local Juejin draft assistant. Before running the optional Playwright script, install dependencies in a controlled environment, confirm you are using the intended Juejin account, keep the browser visible, and manually review the draft, tags, summary, and final publish action.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

The helper can place generated content into your Juejin editor while you are logged in, so mistakes could affect your creator workspace if you proceed manually.

Why it was flagged

The skill is intended to operate inside a user's already logged-in Juejin creator session, which is account-level authority even though the artifacts say it must not read cookies or publish automatically.

Skill content

- 在用户已登录状态下打开创作页面。
- 辅助填写标题、正文、摘要。

Recommendation

Use it only with the intended Juejin account, keep the browser visible, and review all fields before saving or publishing.

Low

#ASI02: Tool Misuse and Exploitation

What this means

If a user edits or invokes the script with save_draft=True, it may click the Juejin save-draft button on their behalf.

Why it was flagged

The script contains an optional save-draft path, but the included entry point calls run(save_draft=False), so account mutation is not the default behavior.

Skill content

if save_draft:
                page.click("button:has-text('保存草稿')", timeout=5000)
            else:
                print("[!] 根据安全策略 (save_draft=False)，不自动保存草稿，请人工确认后手动保存。")

Recommendation

Leave the default save_draft=False unless you intentionally want automated draft saving, and manually inspect the editor before any account action.

Info

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing these dependencies can add third-party code and browser binaries to your environment.

Why it was flagged

The README instructs a user-directed install of Playwright and browser binaries, while the registry metadata has no install spec. This is expected for the browser automation purpose but still introduces external dependencies.

Skill content

安装依赖：`pip install playwright && playwright install`

Recommendation

Install dependencies only in a trusted environment, preferably in a virtual environment, and review the script before running it.