Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Baoyu Post To Weibo

v1.103.2

Posts content to Weibo (微博). Supports regular posts with text, images, and videos, and headline articles (头条文章) with Markdown input via Chrome CDP. Use when...

1· 1.2k·36 current·37 all-time
byJim Liu 宝玉@jimliu

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for jimliu/baoyu-post-to-weibo.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Baoyu Post To Weibo" (jimliu/baoyu-post-to-weibo) from ClawHub.
Skill page: https://clawhub.ai/jimliu/baoyu-post-to-weibo
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install baoyu-post-to-weibo

ClawHub CLI

Package manager switcher

npx clawhub@latest install baoyu-post-to-weibo
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description match the included scripts: posting regular Weibo posts and headline articles via Chrome CDP. Helper scripts (markdown → HTML, clipboard copy, real paste) are coherent with the stated functionality. The declared required binaries (bun or npx) align with how the scripts are invoked.
!
Instruction Scope
SKILL.md instructs the agent to run local TypeScript scripts that manipulate Chrome via CDP, access/create Chrome profile directories, read EXTEND.md from user/profile locations, and run platform clipboard/paste commands (swift, xclip, xdotool, powershell). Critically, troubleshooting text instructs the agent to automatically kill only CDP Chrome instances (pkill with a profile-specific pattern) and to retry without asking the user. That gives the skill discretionary authority to terminate local browser processes and operate on user profile directories — beyond a passive 'fill-in-and-wait-for-user' workflow.
Install Mechanism
There is no remote installer; this is instruction-only with bundled scripts. No download-from-arbitrary-URL install step was provided. The project includes a bun.lock and package.json (dependencies) but no automatic installer, so execution relies on local runtimes (bun or npx).
Credentials
The registry metadata declares no required environment variables or credentials, which fits a local automation tool. However, the code references an optional WEIBO_BROWSER_CHROME_PATH env var when Chrome isn't found, but this env var is not declared in the metadata (minor mismatch). The scripts read/write user config/profile directories (EXTEND.md locations and Chrome profile paths) and create temp files — access to these paths is justified for reusing/creating profiles but is more sensitive than typical for a simple posting helper.
!
Persistence & Privilege
always:false (good). But the skill persists and reuses Chrome profiles, creates profile directories under user config, and contains instructions to automatically kill Chrome instances tied to its profile when a CDP error occurs. Combined with normal autonomous invocation, that gives the skill the ability to modify and terminate local browser processes without prompting — a potentially disruptive privilege the user should be comfortable granting.
What to consider before installing
This skill appears to implement posting to Weibo using a real Chrome instance and local helper scripts; that is coherent with its description. However: 1) it will access and create Chrome profile directories (in your home/config) and may reuse or modify those profiles — back up any important browser profile before use; 2) the runtime explicitly tells the agent to automatically kill CDP-launched Chrome processes tied to the skill's profile when errors occur — consider whether you want a skill to terminate browser processes without confirmation; 3) the scripts spawn platform tools (swift, xclip, xdotool, powershell, pkill), so they will execute arbitrary system commands appropriate to the OS — review the bundled scripts (especially weibo-utils.ts) before enabling autonomous invocation; 4) the metadata doesn't declare an optional env var referenced in code (WEIBO_BROWSER_CHROME_PATH) — be aware you may need to set it if Chrome isn't auto-detected. Recommendation: run the scripts locally manually first to observe behavior and test in a throwaway browser profile, or require the agent to ask for explicit permission before killing/restarting browser processes or operating on your default profile.
scripts/copy-to-clipboard.ts:59
Shell command execution detected (child_process).
scripts/paste-from-clipboard.ts:54
Shell command execution detected (child_process).
scripts/weibo-utils.ts:45
Shell command execution detected (child_process).
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

Any binbun, npx
latestvk974gnqqbwrgmwhgraxe8hg24s858ar9
1.2kdownloads
1stars
9versions
Updated 9h ago
v1.103.2
MIT-0

Post to Weibo

Posts text, images, videos, and long-form articles to Weibo via real Chrome browser (bypasses anti-bot detection).

Script Directory

Important: All scripts are located in the scripts/ subdirectory of this skill.

Agent Execution Instructions:

  1. Determine this SKILL.md file's directory path as {baseDir}
  2. Script path = {baseDir}/scripts/<script-name>.ts
  3. Replace all {baseDir} in this document with the actual path
  4. Resolve ${BUN_X} runtime: if bun installed → bun; if npx available → npx -y bun; else suggest installing bun

Script Reference:

ScriptPurpose
scripts/weibo-post.tsRegular posts (text + images)
scripts/weibo-article.tsHeadline article publishing (Markdown)
scripts/copy-to-clipboard.tsCopy content to clipboard
scripts/paste-from-clipboard.tsSend real paste keystroke

Preferences (EXTEND.md)

Check EXTEND.md in priority order — the first one found wins:

PriorityPathScope
1.baoyu-skills/baoyu-post-to-weibo/EXTEND.mdProject
2${XDG_CONFIG_HOME:-$HOME/.config}/baoyu-skills/baoyu-post-to-weibo/EXTEND.mdXDG
3$HOME/.baoyu-skills/baoyu-post-to-weibo/EXTEND.mdUser home

If none found, use defaults.

EXTEND.md supports: Default Chrome profile

Prerequisites

  • Google Chrome or Chromium
  • bun runtime
  • First run: log in to Weibo manually (session saved)

Regular Posts

Text + images/videos (max 18 files total). Posted on Weibo homepage.

${BUN_X} {baseDir}/scripts/weibo-post.ts "Hello Weibo!" --image ./photo.png
${BUN_X} {baseDir}/scripts/weibo-post.ts "Watch this" --video ./clip.mp4

Parameters:

ParameterDescription
<text>Post content (positional)
--image <path>Image file (repeatable)
--video <path>Video file (repeatable)
--profile <dir>Custom Chrome profile

Note: Script opens browser with content filled in. User reviews and publishes manually.


Headline Articles (头条文章)

Long-form Markdown articles published at https://card.weibo.com/article/v3/editor.

${BUN_X} {baseDir}/scripts/weibo-article.ts article.md
${BUN_X} {baseDir}/scripts/weibo-article.ts article.md --cover ./cover.jpg

Parameters:

ParameterDescription
<markdown>Markdown file (positional)
--cover <path>Cover image
--title <text>Override title (max 32 chars, truncated if longer)
--summary <text>Override summary (max 44 chars, auto-regenerated if longer)
--profile <dir>Custom Chrome profile

Frontmatter: title, summary, cover_image supported in YAML front matter.

Character Limits:

  • Title: 32 characters max (truncated with warning if longer)
  • Summary/导语: 44 characters max (auto-regenerated from content if longer)

Markdown-to-HTML: Do NOT pass any --theme parameter when converting markdown to HTML. Use the default theme (no theme argument).

Article Workflow:

  1. Opens https://card.weibo.com/article/v3/editor
  2. Clicks "写文章" button, waits for editor to become editable
  3. Fills title (validated for 32-char limit)
  4. Fills summary/导语 (validated for 44-char limit)
  5. Inserts HTML content into ProseMirror editor via paste
  6. Replaces image placeholders one by one (copy image → select placeholder → paste)

Post-Composition Check: The script automatically verifies after all images are inserted:

  • Remaining WBIMGPH_ placeholders in editor content
  • Expected vs actual image count

If the check fails (warnings in output), alert the user with the specific issues before they publish.


Post Type Selection

Unless the user explicitly specifies the post type:

  • Markdown file (.md) → Headline Article (头条文章)
  • Plain text / text with images → Regular Post

Troubleshooting

Chrome debug port not ready

If a script fails with Chrome debug port not ready or Unable to connect, kill only the CDP Chrome instances (those with --remote-debugging-port AND the baoyu-skills profile), then retry:

pkill -f "remote-debugging-port.*baoyu-skills/chrome-profile" 2>/dev/null; sleep 2

CRITICAL: Never kill all Chrome processes (pkill -f "Google Chrome"). Only kill Chrome instances launched by CDP with the baoyu-skills profile directory. The user may have regular Chrome windows open.

Important: This should be done automatically -- when encountering this error, kill the CDP Chrome instances and retry the command without asking the user.

Notes

  • First run: manual login required (session persists)
  • All scripts only fill content into the browser, user must review and publish manually
  • Cross-platform: macOS, Linux, Windows

Extension Support

Custom configurations via EXTEND.md. See Preferences section for paths and supported options.

Comments

Loading comments...