Weibo Publish

PassAudited by VirusTotal on May 11, 2026.

Overview

Type: OpenClaw Skill Name: weibo-publish Version: 1.0.0 The skill bundle provides instructions and examples for automating posts on Weibo (m.weibo.cn) using browser automation. It includes standard procedures for text entry, image uploading from a designated temporary directory (/tmp/openclaw/uploads/), and post verification. While it utilizes shell commands (exec) for file cleanup (rm) and maintenance (find), these actions are scoped to the skill's own temporary files and the agent's media directory (~/.openclaw/media/browser/) for housekeeping purposes, with no evidence of malicious intent or data exfiltration.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Concern

ASI02: Tool Misuse and Exploitation

What this means

An agent following the workflow could publish content to the user's Weibo account before the user has reviewed the final text, images, or active account.

Why it was flagged

This instructs the agent to perform the final public posting action through browser automation. The workflow does not include an explicit final approval step before clicking Send.

Skill content

Click the send button:
```javascript
browser act kind=click ref=<send-button-ref>
```

Recommendation

Require an explicit confirmation immediately before sending, showing the target account, exact text, selected images, and whether the post will be public.

Note

ASI03: Identity and Privilege Abuse

What this means

If the wrong browser profile or Weibo account is active, the post could be made from the wrong identity.

Why it was flagged

The skill uses the user's existing authenticated Weibo browser session. This is expected for publishing, but it means actions occur with the privileges of the logged-in account.

Skill content

Requires existing login session via browser cookies.

Recommendation

Verify the active Weibo account before use, and consider using a dedicated browser profile for automated posting.

Note

ASI05: Unexpected Code Execution

What this means

A mistaken filename or overly broad cleanup command could remove temporary files or old browser screenshots the user intended to keep.

Why it was flagged

The skill documents local shell cleanup commands that delete temporary uploads and old browser screenshots. These are purpose-aligned cleanup steps, but they still mutate local files.

Skill content

rm /tmp/openclaw/uploads/<filename>
find ~/.openclaw/media/browser/ -type f -mtime +7 -delete

Recommendation

Delete only the files copied for the current posting task, and review any cleanup command before running it.