多平台视频发布

多平台短视频自动发布工具，支持抖音、视频号、快手、小红书、B站。当用户说"发布视频"、"上传视频到抖音/小红书/视频号/快手/B站"、"把视频发到所有平台"、"登录抖音"、"视频发布"等时使用此 skill。底层使用 Playwright + 本机 Chrome 操作各平台创作者后台完成自动发布，所有代码自包含在...

Security Scan

Skill broadly matches its stated purpose (automated multi‑platform uploads) but contains a few inconsistencies and undeclared requirements (Playwright/Chrome, pip installs, a Bilibili executable reference, and an external XHS signing endpoint) that you should review before installing.

Purpose & Capability

Name/description claim to automate uploads using Playwright + local Chrome and all code is in scripts/ — that matches the included uploader modules. However the SKILL metadata declares no required env/binaries while the code clearly requires a local Chrome, Python packages (playwright, biliup, etc.), and (implicitly) a biliup executable for B站. The README/SKILL.md also references an XHS_SERVER signing service. The '完全自包含，无外部依赖路径' statement is therefore misleading.

Instruction Scope

SKILL.md instructs the agent to run setup.py and publish.py (login/run), check and write cookie files under scripts/cookies, and open browser windows for QR/manual login. Those instructions stay within the uploader/publishing scope. Note: the agent will read/write cookies (sensitive authentication tokens) and will invoke subprocesses and Playwright-controlled browsers per the script; this behavior is expected for the stated purpose but is sensitive in nature.

Install Mechanism

No platform install spec is provided (instruction-only), but setup.py performs pip installs (playwright, biliup, loguru, requests) and runs 'playwright install chromium' which downloads browser binaries. That's a moderate-risk installation action (third‑party packages and browser binaries). The pip packages listed are common, and no unusual download URLs are used in the code, but the runtime will download Chromium via Playwright.

Credentials

Declared metadata lists no required env vars, yet code and docs reference VIDEO_DIR, CHROME_PATH (CHROME_PATH/LOCAL_CHROME_PATH), and XHS_SERVER. XHS_SERVER is used for remote signing via requests.post — default is http://127.0.0.1:11901 but can be pointed elsewhere. The skill saves and reads cookies from scripts/cookies (sensitive credentials). The environment/credential requirements are relevant to function but are not reflected in the skill metadata and the presence of an external signing endpoint increases attack surface if misconfigured.

Persistence & Privilege

always:false (normal). The skill writes conf.py (setup writes detected Chrome path) and stores cookies under scripts/cookies; this is expected for a publishing tool. It does not request elevated system-wide privileges or attempt to modify other skills. Autonomous invocation is allowed (platform default) — combine that with cookie access if you intend to allow automatic runs.

What to consider before installing

This skill appears to implement what it says (automated multi‑platform uploads) but has some inconsistencies you should address before trusting it: 1) The skill metadata lists no environment requirements but the code needs a local Chrome, Python packages (playwright, biliup, etc.) and may expect a biliup executable — verify the biliup binary included with the package is legitimate. 2) setup.py will run pip install and playwright install (it will download Chromium) — run that manually in an isolated environment first. 3) The skill saves/account cookies under scripts/cookies; those files contain account session data — treat them as sensitive and store them securely. 4) Xiaohongshu signing can call an XHS_SERVER (default localhost) — ensure you run your own local signing service or keep XHS_SERVER pointed to localhost; do not point it to an untrusted remote server. 5) If you plan to let the agent invoke this skill autonomously, be aware it can read/write cookies and run browser automation (which could interact with logged‑in accounts). Recommended actions: inspect the bundled biliup executable (if present), run setup.py and publish.py manually in a controlled environment first, confirm XHS_SERVER behavior, and back up/remove any saved cookie files for accounts you do not want automated. If you want, provide me with specific files (e.g., the Bilibili uploader folder or any included executables) and I can look for anomalies in those binaries or scripts.

video-publisher

完全自包含的多平台短视频发布 skill。所有代码在 scripts/ 目录内，无外部依赖路径。

目录结构

scripts/
├── publish.py          # 统一入口（登录 + 发布）
├── setup.py            # 首次安装向导（检测 Chrome、安装依赖）
├── conf.py             # 配置（Chrome 路径由 setup.py 自动写入）
├── videos/             # 待发布视频放这里
├── cookies/            # 各平台登录状态（自动生成）
├── uploader/           # 各平台发布模块（来自 SAU）
│   ├── douyin_uploader/
│   ├── tencent_uploader/
│   ├── ks_uploader/
│   ├── xhs_uploader/
│   └── bilibili_uploader/
└── utils/              # 工具模块

视频目录规范

默认在 scripts/videos/ 下放置视频，也可通过环境变量 VIDEO_DIR 指定其他目录：

export VIDEO_DIR=/path/to/your/videos  # Linux/macOS
$env:VIDEO_DIR = "E:\openclaw\video"   # Windows PowerShell

视频文件格式：

视频名.mp4       # 视频（必须）
视频名.txt       # 第一行标题，第二行 #标签1 #标签2（必须）
视频名.png       # 封面图（可选）

首次安装

cd scripts/
python setup.py

自动完成：检测 Chrome 路径、安装 playwright/biliup 等依赖、写入 conf.py。

常用操作

登录（每个平台首次或 cookie 过期时执行一次）

python publish.py login douyin    # 抖音（扫码）
python publish.py login tencent   # 视频号（微信扫码）
python publish.py login ks        # 快手（扫码）
python publish.py login xhs       # 小红书（手动登录后按 Enter）
python publish.py login bilibili  # B站（biliup 扫码）

发布

python publish.py run douyin      # 发布到抖音
python publish.py run tencent     # 发布到视频号
python publish.py run ks          # 发布到快手
python publish.py run xhs         # 发布到小红书
python publish.py run bilibili    # 发布到B站
python publish.py run all         # 发布到所有已登录平台

通过 OpenClaw 使用

直接说：

• "发布视频到抖音"
• "把 videos 里的视频发到所有平台"
• "抖音 cookie 过期了，重新登录"

OpenClaw 会自动定位到 skill 的 scripts/ 目录执行对应命令。

Agent 操作规范

1. 用户说"发布视频到 X 平台"
2. 检查 scripts/cookies/<platform>_uploader/account.json 是否存在
3. 不存在 → 执行 python publish.py login <platform>，告知用户扫码
4. 存在 → 执行 python publish.py run <platform>
5. 观察输出，完成后告知用户结果

执行命令时需先设置 Python 路径（Windows）：

$env:PATH = '<python_dir>;<python_scripts_dir>;' + $env:PATH
python publish.py run douyin

详细平台说明见 references/platforms.md