Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

App Publish

v1.0.5

自动化在快手、B站和抖音三个平台通过Chrome浏览器脚本发布视频,支持标题、封面、关键词填充及登录检查。

0· 85·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for xiaohei2022/app-publish.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "App Publish" (xiaohei2022/app-publish) from ClawHub.
Skill page: https://clawhub.ai/xiaohei2022/app-publish
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install app-publish

ClawHub CLI

Package manager switcher

npx clawhub@latest install app-publish
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description match the code and SKILL.md: the package implements Chrome/CDP-based automation to publish videos to Kuaishou, Bilibili and Douyin. Required capabilities (CDP, file inputs, selectors) align with the stated purpose.
Instruction Scope
SKILL.md restricts actions to running the provided Python CLI and browser automation. The code adheres to that (navigating upload pages, setting file inputs, filling forms). However the CDP client can execute arbitrary JS on pages and debug helpers save full page HTML to disk — meaning the skill can read page content, DOM, and potentially data in pages (cookies/localStorage visible via JS) if run against an authenticated browser session. This is expected for automation but important to be aware of.
Install Mechanism
This is an instruction+code skill with no install spec; dependencies are standard Python packages (requests, websockets) declared in pyproject and requirements.txt. No downloads from external URLs or archive extraction are present in the manifest.
!
Credentials
Manifest declares no required env vars, but code reads CHROME_BIN and proxy env vars (KBS_PROXY, HTTPS_PROXY, HTTP_PROXY) and uses a default user-data-dir (~/.kbs/chrome-profile). The skill will therefore interact with environment variables and a browser profile not declared in the registry metadata. Also, because it connects to a running Chrome debug port and can reuse a profile, it will operate with whatever authenticated sessions exist in that profile — a high-impact capability that should be explicit to users.
Persistence & Privilege
The skill does not request always:true and is not force-enabled. It may create/use a local Chrome profile directory (~/.kbs/chrome-profile) and can spawn/terminate Chrome processes (including killing processes listening on the CDP port). Those are reasonable for a browser-automation tool but constitute local persistence and process-control privileges the user should accept consciously.
What to consider before installing
What to consider before installing: - Functionally this package does what it claims: it automates Chrome to upload videos and fill forms. That requires access to your local video/cover files and to a Chrome session that is logged in to the target platforms. - High-impact capability: it connects to a Chrome debug port and can reuse a browser profile — if you point user-data-dir at a profile that contains your real accounts the skill will act with those authenticated sessions. Use a dedicated Chrome profile (create a new user-data-dir) to isolate credentials. - The code executes arbitrary JS in pages and can save page HTML to disk (debug helpers). Treat it as able to read page content, DOM, and client-side data; do not run it against sensitive accounts unless you trust the author. - Environment variables: CHROME_BIN and proxy env vars (KBS_PROXY/HTTP[S]_PROXY) are respected though not listed in the registry metadata. Do not set a proxy you don't trust. - Safety steps: review the full source locally, run first with --no-publish to confirm behavior, run in an isolated environment or VM, and point --user-data-dir to a throwaway Chrome profile. If you need higher assurance, have a developer audit the remaining omitted files or run the skill in a sandboxed environment.

Like a lobster shell, security has layers — review code before you run it.

latestvk974gvry8fev910fzsx9cwytzh8463gx
85downloads
0stars
3versions
Updated 3w ago
v1.0.5
MIT-0

快手/B 站/抖音视频发布技能

🎯 技能概述

参考小红书发布技能(xiaohongshu-skills)的结构,为快手、B 站、抖音三个平台提供视频发布自动化能力。

目标平台:


📝 2026-04-03 更新

快手平台特殊规则

关键词格式:

  • 快手最多支持 4 个关键词
  • 每个关键词前加 #,后加空格
  • 示例:#美好的 #欢快 #一天的

封面上传流程:

  1. 点击「封面设置」按钮
  2. 切换到「上传封面」标签
  3. 点击「上传图片」按钮选择文件
  4. 点击「确认」应用封面

作品描述框:

  • 标题和关键词写在同一个描述框中
  • 格式:标题 #关键词 1 #关键词 2 #关键词 3 #关键词 4

🔒 技能边界(强制)

所有发布操作只能通过浏览器自动化脚本完成:

  • 唯一执行方式:运行 python scripts/cli.py <子命令> 控制 Chrome 浏览器
  • 禁止外部工具:不得调用第三方 API、MCP 工具或其他实现
  • 必须先有运行中的 Chrome,且用户已登录对应平台

📋 前置检查

登录状态检查

# 打开对应平台,手动检查登录状态
python scripts/cli.py --platform kuaishou check-login
python scripts/cli.py --platform bilibili check-login
python scripts/cli.py --platform douyin check-login
  • 未登录时提示用户扫码登录
  • 支持 --headless 模式(未登录自动降级到有窗口模式)

📥 输入格式

TXT 配置文件格式

标题:明天更好
视频数据路径:/Users/xiaohei/.openclaw/workspace/skills/app_publish/test_data/test_video.mp4
封面:/Users/xiaohei/.openclaw/workspace/skills/app_publish/test_data/image.png
关键词:美好的,欢快,一天的

字段说明:

  • 标题:视频标题(必填)
  • 视频数据路径:视频文件绝对路径(必填)
  • 封面:封面图片绝对路径(可选)
  • 关键词:逗号或空格分隔的关键词/标签(可选)

🚀 发布流程

流程 A: 单平台发布

快手发布

cd /Users/xiaohei/.openclaw/workspace/skills/app_publish/scripts

# 完整发布(填写 + 点击发布)
python cli.py publish-kuaishou --config ../test_data/描述.txt

# 只填写表单,不发布(用于预览确认)
python cli.py publish-kuaishou --config ../test_data/描述.txt --no-publish

# 指定等待超时时间(秒)
python cli.py publish-kuaishou --config ../test_data/描述.txt --wait-timeout 600

B 站发布

# 完整发布
python cli.py publish-bilibili --config ../test_data/描述.txt

# 分步发布
python cli.py publish-bilibili --config ../test_data/描述.txt --no-publish
# 在浏览器中确认预览后,手动点击发布

抖音发布

# 完整发布
python cli.py publish-douyin --config ../test_data/描述.txt

# 指定 Chrome 端口
python cli.py publish-douyin --config ../test_data/描述.txt --port 9222

流程 B: 多平台一键发布

# 依次发布到快手、B 站、抖音
python cli.py publish-all --config ../test_data/描述.txt

# 带超时设置
python cli.py publish-all --config ../test_data/描述.txt --wait-timeout 300

注意: publish-all 会在同一浏览器会话中依次执行三个平台的发布,总耗时可能较长(每个平台约 1-3 分钟)。


🛠️ 常用参数

参数说明默认值
--config pathTXT 配置文件路径(必须)-
--wait-timeout seconds上传等待超时时间300
--no-publish只填写表单,不点击发布false
--port PORTChrome CDP 端口9222
--host HOSTChrome CDP 主机127.0.0.1
--headless无头模式false
--user-data-dir pathChrome 用户数据目录~/.kbs/chrome-profile

📤 输出格式

成功输出

{
  "success": true,
  "platform": "bilibili",
  "title": "明天更好",
  "video_path": "/path/to/video.mp4",
  "cover_path": "/path/to/cover.png",
  "keywords": ["美好的", "欢快", "一天的"],
  "status": "发布完成",
  "message": "视频上传成功,表单已填写"
}

失败输出

{
  "success": false,
  "platform": "kuaishou",
  "error": "上传超时,请检查网络连接或视频文件大小",
  "status": "上传失败"
}

⚠️ 失败处理

错误类型可能原因解决方案
上传超时视频文件过大、网络慢增加 --wait-timeout 参数
登录失效Cookie 过期重新登录对应平台
选择器失效页面结构变更更新 selectors_*.py 中的 CSS 选择器
文件不存在路径错误检查 TXT 配置中的文件路径
Chrome 未启动调试端口未开放确保 Chrome 以 --remote-debugging-port=9222 启动

📁 项目结构

app_publish/
├── scripts/
│   ├── cli.py                     # CLI 入口(6.8KB)
│   ├── chrome_launcher.py         # Chrome 启动器(9KB)
│   ├── requirements.txt           # Python 依赖
│   └── kbs/                       # 核心模块
│       ├── __init__.py
│       ├── cdp.py                 # CDP 封装(22KB)
│       ├── types.py               # 数据类型 + 配置解析(4KB)
│       ├── selectors_ks.py        # 快手选择器(1.5KB)
│       ├── selectors_bili.py      # B 站选择器(1.1KB)
│       ├── selectors_dy.py        # 抖音选择器(859B)
│       ├── publish_kuaishou.py    # 快手发布逻辑(4.5KB)
│       ├── publish_bilibili.py    # B 站发布逻辑(4KB)
│       └── publish_douyin.py      # 抖音发布逻辑(4.5KB)
├── test_data/
│   ├── test_video.mp4             # 测试视频
│   ├── image.png                  # 测试封面
│   └── 描述.txt                   # 测试配置
├── 任务.md                        # 任务需求文档
└── SKILL.md                       # 技能说明文档(本文件)

🎯 实现状态

✅ 已完成:

  • CLI 入口和参数解析
  • Chrome 连接和会话管理
  • 三平台选择器定义
  • 视频上传(使用 CDP DOM.setFileInputFiles)
  • 封面上传
  • 标题/关键词填写
  • 上传状态轮询(最多 5 分钟)
  • 单平台/多平台发布模式

⚠️ 待完善:

  • 实际页面选择器需要验证(不同时间页面结构可能变化)
  • 视频上传进度监控需要实际测试优化
  • 分区选择功能(B 站)需要实现
  • 定时发布功能需要实现
  • 封面上传功能需要实际测试

📝 注意事项

  1. CSS 选择器:基于常见页面结构推断,实际使用时可能需要根据目标网站的最新页面结构调整
  2. 视频上传:大文件上传时间较长,建议设置 --wait-timeout 600 或更长
  3. 登录状态:发布前请确保已在 Chrome 中登录对应平台
  4. 浏览器复用:使用 --port 9222 可复用已登录的 Chrome 会话
  5. 错误处理:上传失败时会抛出异常并返回错误信息

🔧 依赖安装

cd /Users/xiaohei/.openclaw/workspace/skills/app_publish/scripts
pip install -r requirements.txt
# 或手动安装
pip install requests websockets

开发时间: 2026-04-02
参考技能: xiaohongshu-skills/xhs-publish
开发工具: Cursor CLI Agent

Comments

Loading comments...