ZeeLin多平台自运营

ZeeLin多平台自运营 — 通义千问 +《四大平台内容生产提示词手册》生成各平台稿，CDP 顺序运营 X / 微博 / 小红书 / 微信公众号草稿。MIT-0 on ClawHub.

Security Scan

The package implements multi‑platform autopublishing (using Chrome CDP and an optional DashScope/QWEN API) which matches its description, but the registry metadata omits important runtime requirements (API keys, a running Chrome with remote debugging and logged‑in accounts) and the scripts automatically source local env files and drive browser sessions — review before installing or running.

Purpose & Capability

The skill's name/description (multi‑platform autopublisher) matches the included code: content generation + Chrome CDP automation for X/Weibo/XHS/WeChat. However the registry metadata declares no required env vars or binaries while the scripts clearly expect: a running local Chrome/Chromium with --remote-debugging-port, and optional API keys (DASHSCOPE_API_KEY / QWEN_API_KEY). That mismatch (metadata understates requirements) is an incoherence users should notice.

Instruction Scope

Runtime instructions tell you to run the provided shell wrappers which will: source a local ~/.openclaw/zeelin-qwen.env if present, call generate_content.py (which will call DashScope/Qwen or fall back to templates), enumerate Chrome CDP tabs, extract tokens from tab URLs (WeChat token), execute JavaScript in pages to fill forms and click publish, and provide continuous/looping autoops scripts. These actions go beyond simple text generation: they read local env files, inspect browser tabs (including URL query parameters), and drive logged‑in browser sessions — all of which are powerful and can result in posting from your accounts.

Install Mechanism

No install spec is supplied (instruction‑only skill with bundled scripts). This is lower installation risk than an arbitrary download/install step — nothing external is installed by the skill itself.

Credentials

The package uses several environment variables (DASHSCOPE_API_KEY / QWEN_API_KEY / QWEN_API_BASE / OPENCLAW_CDP_PORT / OPENCLAW_SKILLS_ROOT / OPENCLAW_CLI / THUQX_ALLOW_TEMPLATE_FALLBACK etc.) but the registry metadata lists none. In particular, the scripts will source ~/.openclaw/zeelin-qwen.env automatically if present; that file may contain secrets. The use of a remote LLM API key (DashScope/Qwen) is justified for content generation, but the skill should have declared these requirements explicitly.

Persistence & Privilege

always:false (good). However the skill includes 'continuous' looping scripts (run_continuous_ops.sh / run_autoops_engine.sh) which will repeatedly generate and post content if started. The skill can be invoked autonomously by the agent (platform default); combined with browser control, that could autonomously publish posts — be cautious about allowing unattended invocation.

What to consider before installing

What to check before installing or running this skill: - Metadata mismatch: the package DOES expect a local Chrome/Chromium with remote debugging (--remote-debugging-port) and may use a DashScope/QWEN API key, but the registry entry lists no required env vars — assume you must supply these manually. - Browser control: the scripts connect to Chrome DevTools Protocol, enumerate tabs, extract tokens from tab URLs (WeChat) and execute JS to fill forms and click publish. Only use with a dedicated browser profile where you are signed into the correct accounts; do not run against a primary browser profile with other sensitive sessions. - Secrets handling: the scripts will source ~/.openclaw/zeelin-qwen.env if present. Inspect that file before creating it; do not put unrelated or high‑privilege secrets there. If you provide DASHSCOPE_API_KEY / QWEN_API_KEY, ensure you understand DashScope's access and billing implications. - Test in dry‑run: run the provided test scripts (run_four_platform_test.sh) or run components manually and observe behavior before enabling continuous mode. Consider modifying scripts to a 'fill only / save draft' mode for first runs. - Autonomous runs: avoid granting the agent unrestricted autonomous invocation if you are not prepared for automatic posting. If possible, run the skill interactively and review generated content before publishing. - Source trust: the skill source and owner are unknown and there is no homepage. If you require stronger assurance, run the code in a sandboxed environment, or review every script line‑by‑line (particularly CDP JS snippets) before use.

ZeeLin多平台自运营 — 自包含包：根目录为技能根，scripts/generate_content.py 与同目录 四大平台内容生产提示词手册.md 需一并保留。

解压/安装后，在技能根目录执行：

bash scripts/run_social_ops_v5.sh "你的主题"

须配置 DashScope（DASHSCOPE_API_KEY 等）；可将 ~/.openclaw/zeelin-qwen.env 置于本机并由 _thuqx_cdp_common.sh 自动 source（若存在）。

详见包内 OPENCLAW.md（若附带）或 README.md。