Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

跨平台内容自动发布

v1.0.0

跨平台内容自动化发布工作流,支持AI原创内容生成、视频制作、自动发布到小红书、抖音等平台,支持国内视频搬运去重后发布到TikTok/YouTube。

1· 102·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for xiatian5/cross-platform-auto-poster.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "跨平台内容自动发布" (xiatian5/cross-platform-auto-poster) from ClawHub.
Skill page: https://clawhub.ai/xiatian5/cross-platform-auto-poster
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install cross-platform-auto-poster

ClawHub CLI

Package manager switcher

npx clawhub@latest install cross-platform-auto-poster
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The README/SKILL.md claim a full end-to-end pipeline (AI content generation, video downloading, de-duplication, cross‑posting). However many core pieces in the shipped code are placeholders/stubs (e.g., generateContent returns empty content, downloadVideos returns [] in src/workflows/video-cross-post.js). The project also relies on external skills/peerDependencies (xiaohongshu-content-automation, playwright-browser-automation, remotion-video-toolkit) rather than implementing them. This mismatch between claimed functionality and delivered implementation is significant: the skill advertises capabilities it doesn't implement locally and expects other components to provide them.
!
Instruction Scope
Runtime instructions direct the agent/user to install Playwright and ffmpeg and to configure cookie files (config/accounts.json). The code reads/writes local cookie/storageState files under auth/ and writes logs to output/. Publishers use Playwright to navigate platform sites and save storageState (cookies). The publishers also add evasive automation changes (navigator.webdriver override in xiaohongshu-publisher.js) and set geolocation/permissions in tiktok-publisher.js — behavior intended to avoid detection and to present a US location. Those behaviors are coherent with cross-posting purpose but expand scope to include actions that can affect account fingerprinting and location spoofing. Also, SKILL.md instructs video downloading/scraping but the implementation for downloading is missing, so actual runtime behavior depends on additional tools/code not present here.
Install Mechanism
This is instruction-only with code files included; there is no install script that fetches remote archives. package.json has no runtime dependencies but lists peerDependencies. The SKILL.md asks users to run npm install and npx playwright install and to install ffmpeg manually — standard for this type of tool. No external arbitrary download URLs or opaque installers are present in the repo.
Credentials
The skill declares no required environment variables or credentials, which aligns with what is shipped. However it requires storing and reading browser storageState files (cookies) under auth/ and config/accounts.json; those files contain session tokens and should be treated as sensitive. The code will save authentication state (context.storageState) to user-specified cookiePath and read it back to automate logins. Requesting cookie files (not env secrets) is proportionate to automated publishing, but it creates a sensitive local credential surface that users must protect.
Persistence & Privilege
The skill does not request always:true and does not modify other skills or system-wide settings. It writes its own auth/ and output/ files (saving session state and logs), which is expected for this functionality. Autonomous invocation is allowed (default) but not combined with any exceptional privileges.
What to consider before installing
This skill automates browser logins and saves session cookies locally, and it includes code to spoof/evade automation detection (navigator.webdriver override, geolocation). Before installing: (1) Understand that auth files saved under auth/ (storageState cookies) are sensitive—store them securely and remove them if you stop using the skill. (2) The repo advertises full scraping, AI-generation and downloading workflows but many functions are placeholders; you will need to provide or trust external tools/skills (yt-dlp, xiaohongshu-content-automation, remotion, TTS) to get full behavior. (3) Automating cross-posting of others' content may violate platform rules or copyright—ensure you have rights to repost. (4) If you proceed, review the publishers' automation scripts and config paths, and run them in a controlled environment (separate accounts) until you confirm behavior. If you want a safer alternative, use tools that rely on official platform APIs and OAuth rather than browser cookie reuse and UI automation.
src/workflows/video-cross-post.js:111
Shell command execution detected (child_process).
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.

Like a lobster shell, security has layers — review code before you run it.

automationvk972bdd25hfyzqt57j40t50mas83xqtvcross-platformvk972bdd25hfyzqt57j40t50mas83xqtvlatestvk972bdd25hfyzqt57j40t50mas83xqtvsocial-mediavk972bdd25hfyzqt57j40t50mas83xqtvtiktokvk972bdd25hfyzqt57j40t50mas83xqtvxiaohongshuvk972bdd25hfyzqt57j40t50mas83xqtvyoutubevk972bdd25hfyzqt57j40t50mas83xqtv
102downloads
1stars
1versions
Updated 4w ago
v1.0.0
MIT-0

跨平台内容自动发布 📤🎬

全自动化跨平台内容发布工作流,支持AI原创内容生产 + 自动发布,也支持国内视频搬运去重后发布到海外平台。一键完成从选题到发布全流程,帮你轻松做内容变现。

触发词

当用户说这些话时,调用这个技能:

  • "跨平台自动发布"
  • "自动发布小红书"
  • "视频搬运自动化"
  • "TikTok自动发布"
  • "YouTube自动上传"
  • "内容自动化变现"
  • "小红书自动发文"

功能特性

功能说明
AI原创小红书图文从选题→文案→封面→发布全自动
AI生成口播视频文案转语音+配图生成视频
视频搬运去重自动下载→去重处理→改文案→发布
多平台支持小红书、抖音、TikTok、YouTube
账号隔离支持多账号管理,保存登录状态
数据统计自动记录互动数据,生成报表

支持的工作流

工作流1: AI原创小红书图文 (推荐新手快速起步)

1. 热点选题 → 抓取小红书热搜,推荐热门选题
2. 内容生成 → 生成符合小红书风格的文案
3. 封面制作 → AI生成封面图
4. 自动发布 → 浏览器自动登录,上传图文发布
5. 数据记录 → 记录链接和发布时间

工作流2: AI原创小红书口播视频

1. 选题文案 → 同图文工作流
2. 语音合成 → 文案转自然语音
3. 配图生成 → 根据文案生成配图
4. 视频合成 → 语音+配图+字幕 → 输出视频
5. 自动发布 → 上传视频发布

工作流3: 国内视频搬运到TikTok/YouTube

1. 视频采集 → 按关键词下载热门视频
2. AI去重 → 裁切+翻转+调色+换BGM
3. 翻译改写 → 中文标题文案翻译成英文
4. 自动上传 → 发布到TikTok/YouTube

依赖

  • xiaohongshu-content-automation - 小红书内容生成
  • playwright-browser-automation - 浏览器自动化发布
  • image_generate - AI生成封面图
  • remotion-video-toolkit - 视频合成剪辑
  • openai-whisper-api - 语音识别(字幕生成)
  • ffmpeg - 视频处理(需要安装)

配置说明

首次使用

  1. 安装依赖 npm install 安装 Node 依赖
  2. 安装 playwright 浏览器 npx playwright install chromium
  3. 安装 ffmpeg 并添加到 PATH
  4. 配置账号信息在 config/accounts.json

账号配置模板

{
  "xiaohongshu": [
    {
      "name": "账号1",
      "cookiePath": "./auth/xiaohongshu-account1.json"
    }
  ],
  "tiktok": [],
  "youtube": []
}

使用示例

生成并发布一篇小红书图文

const workflow = require('./src/workflows/xiaohongshu-text-image');

await workflow.run({
  topic: "新手健身5个误区",
  style: "干货",
  accountIndex: 0
});

批量搬运视频到TikTok

const搬运工作流 = require('./src/workflows/video-cross-post');

await 搬运工作流.run({
  sourceKeyword: "fitness tips",
  sourcePlatform: "douyin",
  targetPlatform: "tiktok",
  count: 5
});

最佳实践

  1. 垂直领域 - 专注一个领域比如健身、美妆、美食,更容易做起来
  2. 批量生产 - 一次生成10-20篇,定时分批发布
  3. 数据驱动 - 看哪个选题互动好,多做同类内容
  4. 账号安全 - 一个账号不要发太频繁,避免风控

更新日志

v1.0.0 (2026-03-30)

  • 初始版本
  • 完整的AI原创小红书图文工作流
  • 支持多账号管理
  • 预留了视频搬运和多平台接口

相关技能


如果你觉得这个技能有用,请给它点个星,谢谢!⭐

Comments

Loading comments...