Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Social Media Automation

v1.0.0

自动管理小红书和微信视频号多账号内容发布,支持内容模板、合规审查和数据追踪生成日报。

0· 88·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for dally-bee/mux-social-media-automation.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Social Media Automation" (dally-bee/mux-social-media-automation) from ClawHub.
Skill page: https://clawhub.ai/dally-bee/mux-social-media-automation
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install mux-social-media-automation

ClawHub CLI

Package manager switcher

npx clawhub@latest install mux-social-media-automation
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The SKILL.md content matches the stated purpose (Xiaohongshu and 微信视频号 automation, templates, tracking, reports). However registry/_meta metadata mismatch (ownerId differs between listing and _meta.json) and the package declares no required credentials while the instructions and example code clearly require API tokens, cookies, and webhooks. That mismatch is unexpected and reduces trust.
!
Instruction Scope
Runtime instructions instruct the agent to read/write local credential files (.credentials/), load cookies, launch browsers for automation, call platform APIs, and send daily reports to Feishu. Those actions are within the skill's functional scope but the instructions also reference unspecified external endpoints and secret material without clear limits, and they instruct storing and loading keys/cookies from disk — which broadens the data the agent will touch.
Install Mechanism
No install spec and no code files in the package delivered to the agent (instruction-only). That minimizes installer risk since nothing arbitrary is downloaded or written by an installer. The SKILL.md includes example code, but no automatic install steps are declared.
!
Credentials
The skill declares no required env vars/primary credential, yet examples and scheduler use ACCESS_TOKEN, cookies, and a Feishu webhook (send_to_feishu). The doc also instructs storing secrets in .credentials and gives conflicting encryption guidance (recommend gpg/pass but example code uses cryptography.Fernet with a local key file). Requiring/manage many secrets without declaring them and suggesting a local encryption key file (.credentials/key.key) is disproportionate and insecure if not handled carefully.
Persistence & Privilege
The example includes a scheduler that runs periodic publishing and reporting jobs, which implies long-running processes if deployed. The skill does not request always:true and does not modify other skills, so it does not ask for elevated platform privileges — but the agent/operator must be aware this will perform recurring actions and will access stored credentials over time.
What to consider before installing
This skill appears to implement the promised social-media automation features, but several red flags mean you should be cautious: (1) The listing metadata ownerId differs from the _meta.json ownerId — verify the publisher/registry identity before trusting code. (2) The skill requires sensitive secrets (platform access tokens, cookies, Feishu webhook) even though it declares none; do not run it with real credentials until you confirm where/how secrets are stored. (3) The doc suggests storing an encryption key and encrypted credentials in .credentials/ and the example uses a local Fernet key file — storing the encryption key alongside encrypted data or in the repository is insecure. Prefer a dedicated secret manager or OS-level protected storage. (4) Browser automation can capture login sessions (including MFA cookies); review code that loads cookies and make sure it does not exfiltrate them. (5) There are contradictory recommendations (gpg/pass vs Fernet) — ask the author for a single, secure secret-handling plan and for explicit env var names for any webhooks/API tokens. Recommended next steps: verify the package owner, get the full source code (not only SKILL.md) and an explanation of secret storage and Feishu endpoint usage, and run the code in an isolated environment with least-privilege test credentials. If you cannot validate the author or confirm safe secret handling, do not install or run this skill with production credentials.

Like a lobster shell, security has layers — review code before you run it.

latestvk976b0b5wfykmn3swktsj7txa183kr8j
88downloads
0stars
1versions
Updated 1mo ago
v1.0.0
MIT-0

小红书/视频号全流程自动化技能

社交媒体内容自动发布与运营工作流


📌 技能概述

技能名称: social-media-automation

版本: 1.0.0

适用场景:

  • 小红书笔记自动发布
  • 微信视频号自动发布
  • 多账号矩阵管理
  • 内容日历规划与执行

核心能力:

  • ✅ 账号信息采集与配置
  • ✅ 内容模板库建设
  • ✅ 自动发布(API/浏览器自动化)
  • ✅ 数据追踪与日报生成
  • ✅ 合规风控管理

🎯 标准工作流

Phase 1: 账号交接(30 分钟)

信息采集表:

平台采集项用途
小红书账号名称、类型、认证状态、粉丝量、笔记数、发布频率、内容类型、素材库、API 权限判断技术路线
视频号账号名称、类型、认证状态、粉丝量、视频数、直播情况、关联公众号、小店、API 权限判断技术路线

决策逻辑:

账号类型判断
├── 企业号/专业号 + API 权限 → ✅ 官方 API(稳定、合规)
└── 个人号 / 无 API 权限 → ⚠️ 浏览器自动化(需维护)

凭证管理:

  • 存储位置:.credentials/social-media/
  • 加密方式:gpg 或 pass
  • 禁止明文传输

Phase 2: 内容策略(1 小时)

目标人群定位:

  • □ 减脂人群 □ 增肌人群 □ 产后恢复 □ 中老年健身
  • □ 办公室人群 □ 学生党 □ 其他

内容选题库:

类别选题示例优先级
减脂7 天燃脂计划、HIIT 入门、饮食搭配P0
增肌新手增肌指南、蛋白摄入、力量训练P0
居家无器械训练、办公室拉伸、晨练 routineP1
科普健身误区、动作纠错、装备推荐P1
激励前后对比、打卡挑战、粉丝故事P2

发布节奏:

平台频率时间段
小红书1-2 篇/天7-8 点、20-21 点
视频号1 篇/天 + 直播 2-3 场/周12 点、20 点

合规注意事项:

  • ⚠️ 避免医疗宣称(减脂≠治病)
  • ⚠️ 动作安全提示必须到位
  • ⚠️ 不夸大效果(如"7 天瘦 20 斤")
  • ⚠️ 前后对比图需真实

Phase 3: 技术部署(2-4 小时)

方案 A: 官方 API(推荐)

小红书(蒲公英平台):

# 配置
API_BASE = "https://api.xiaohongshu.com"
ACCESS_TOKEN = "xxx"

# 发布笔记
def publish_note(title, content, images):
    response = requests.post(
        f"{API_BASE}/note/publish",
        headers={"Authorization": f"Bearer {ACCESS_TOKEN}"},
        json={
            "title": title,
            "desc": content,
            "images": images
        }
    )
    return response.json()

视频号:

# 配置
API_BASE = "https://api.weixin.qq.com"
ACCESS_TOKEN = "xxx"

# 发布视频
def publish_video(title, video_url, cover_url):
    response = requests.post(
        f"{API_BASE}/channel/post",
        params={"access_token": ACCESS_TOKEN},
        json={
            "title": title,
            "media_video_url": video_url,
            "cover_url": cover_url
        }
    )
    return response.json()

方案 B: 浏览器自动化(备选)

依赖: Playwright + Cookie 维持登录

from playwright.sync_api import sync_playwright

def publish_xiaohongshu(title, content, images):
    with sync_playwright() as p:
        browser = p.chromium.launch(headless=False)
        page = browser.new_page()
        
        # 加载 Cookie 保持登录
        page.context.add_cookies(load_cookies())
        
        # 访问发布页
        page.goto("https://creator.xiaohongshu.com/publish")
        
        # 填写内容
        page.fill("textarea[placeholder='输入标题']", title)
        page.fill("div[contenteditable='true']", content)
        
        # 上传图片
        file_input = page.input("input[type='file']")
        file_input.set_input_files(images)
        
        # 发布
        page.click("button:has-text('发布')")
        
        browser.close()

Phase 4: 数据追踪(自动化)

日报模板:

## 📊 社交媒体日报 [YYYY-MM-DD]

### 发布情况
| 平台 | 计划 | 实际 | 状态 |
|------|------|------|------|
| 小红书 | 2 | 2 | ✅ |
| 视频号 | 1 | 1 | ✅ |

### 数据汇总
| 平台 | 阅读/播放 | 点赞 | 收藏 | 评论 | 涨粉 |
|------|----------|------|------|------|------|
| 小红书 | 12,345 | 234 | 89 | 12 | +5 |
| 视频号 | 8,901 | 156 | 34 | 8 | +3 |

### 爆款内容 TOP3
1. [标题] - 阅读量 XXXX
2. [标题] - 阅读量 XXXX
3. [标题] - 阅读量 XXXX

### 异常情况
- 无 / [具体描述]

### 优化建议
- [基于数据的改进建议]

数据采集:

  • 小红书:蒲公英平台 API / 手动截图
  • 视频号:视频号助手后台 / 自动化脚本

📁 文件结构

social-media-automation/
├── SKILL.md                 # 技能文档
├── config.py                # 配置管理
├── accounts.py              # 账号管理
├── content_templates.py     # 内容模板库
├── publisher.py             # 发布模块
├── data_tracker.py          # 数据追踪
├── daily_report.py          # 日报生成
└── .credentials/            # 凭证存储(加密)
    ├── xiaohongshu.json.gpg
    └── wechat.json.gpg

🔧 核心代码模块

1. 账号管理

import json
from cryptography.fernet import Fernet

class AccountManager:
    def __init__(self, key_file='.credentials/key.key'):
        self.key = load_key(key_file)
        self.cipher = Fernet(self.key)
    
    def save_account(self, platform, account_info):
        encrypted = self.cipher.encrypt(
            json.dumps(account_info).encode()
        )
        with open(f'.credentials/{platform}.enc', 'wb') as f:
            f.write(encrypted)
    
    def load_account(self, platform):
        with open(f'.credentials/{platform}.enc', 'rb') as f:
            encrypted = f.read()
        decrypted = self.cipher.decrypt(encrypted)
        return json.loads(decrypted.decode())

2. 内容模板库

CONTENT_TEMPLATES = {
    "减脂": {
        "title": "{天数}天燃脂计划 | {效果}",
        "content": """
💪 第{天数}天打卡!

🔥 今日训练:
{训练内容}

🥗 饮食建议:
{饮食内容}

💡 小贴士:
{注意事项}

#减脂 #健身 #{品牌}
""",
        "hashtags": ["减脂", "健身", "燃脂", "自律"]
    },
    "增肌": {
        "title": "新手增肌 | {部位}训练指南",
        "content": """
🏋️ 增肌必看!

💪 目标肌群:{部位}
📊 推荐动作:
{动作列表}

⚠️ 注意事项:
{注意事项}

#增肌 #力量训练 #健身
""",
        "hashtags": ["增肌", "力量训练", "健身"]
    }
}

3. 发布调度器

from apscheduler.schedulers.blocking import BlockingScheduler

scheduler = BlockingScheduler()

@scheduler.scheduled_job('cron', hour=7, minute=30)
def morning_publish():
    """早间发布"""
    content = generate_content("morning")
    publish_xiaohongshu(content)
    publish_wechat(content)
    log_publish_result("morning", True)

@scheduler.scheduled_job('cron', hour=20, minute=0)
def evening_publish():
    """晚间发布"""
    content = generate_content("evening")
    publish_xiaohongshu(content)
    log_publish_result("evening", True)

@scheduler.scheduled_job('cron', hour=22, minute=0)
def daily_report():
    """生成日报"""
    report = generate_daily_report()
    send_to_feishu(report)

if __name__ == '__main__':
    scheduler.start()

⚠️ 故障排查

常见问题

问题原因解决方案
API 调用失败Token 过期刷新 Access Token
发布失败内容违规检查合规用词
Cookie 失效登录态过期重新扫码登录
图片上传失败格式/大小不符转为 JPG,<10MB
数据抓取异常页面结构变更更新选择器

📊 性能指标

指标目标值
发布成功率≥98%
数据延迟<5 分钟
日报准时率100%
内容合规率100%

🔄 自我迭代机制

每周回顾

回顾内容:

  1. 发布成功率分析
  2. 爆款内容特征提取
  3. 用户反馈收集
  4. 平台规则变更追踪

迭代动作:

  • 优化内容模板
  • 调整发布时间
  • 更新合规词库
  • 改进数据追踪

月度升级

  • 新增内容类别
  • 优化发布策略
  • 集成新平台
  • 技能文档版本升级

📝 变更记录

日期版本变更内容
2026-03-25v1.0初始版本,基于已交付项目沉淀

技能文档版本:v1.0 | 最后更新:2026-03-25

Comments

Loading comments...