Naver Blog Publisher

Publish Naver Blog posts through the ACP marketplace flow (buyer-local thin-runner + sealed payload + offering execute). Use when a user asks to write/publis...

Security Scan

The skill's instructions reasonably match a Naver-publishing tool, but the runtime docs reference undeclared tokens, local config files, and an unvetted npm package invoked via npx — inconsistencies that warrant caution before installing.

Purpose & Capability

The declared purpose (publish to Naver Blog from a local runner) aligns with the instructions, but the SKILL.md references several control-plane and auth variables (OPENCLAW_OFFERING_EXECUTE_URL, CONTROL_PLANE_URL + ACP_ADMIN_API_KEY, PROOF_TOKEN, SETUP_URL) that are not declared in the skill metadata. That mismatch between declared requirements (none) and runtime needs is concerning.

Instruction Scope

Runtime instructions tell the agent to run npx @y80163442/naver-thin-runner commands, start a local daemon, and auto-load X_LOCAL_TOKEN from ~/.config/naver-thin-runner/config.json. Those steps require reading a local config file and using tokens that are not listed as required env vars, and they suggest the agent will interact with local browser sessions and a local daemon — all sensitive actions beyond simple HTTP API calls.

Install Mechanism

There is no formal install spec; instead the SKILL.md instructs use of npx to run the scoped npm package @y80163442/naver-thin-runner. npx will fetch and execute code from the npm registry at runtime (user-scoped package), which is a moderate-to-high risk vector unless the package and publisher are verified.

Credentials

The skill metadata lists no required env vars, but the docs reference multiple environment/config items (OPENCLAW_OFFERING_ID, SETUP_URL, PROOF_TOKEN, OPENCLAW_OFFERING_EXECUTE_URL, CONTROL_PLANE_URL, ACP_ADMIN_API_KEY, X_LOCAL_TOKEN) and a local config path. Requesting or using unspecified secrets (ACP_ADMIN_API_KEY, X_LOCAL_TOKEN) is disproportionate and unclear.

Persistence & Privilege

The skill is not marked always:true and uses the platform's normal autonomous invocation setting. That alone is not a red flag, but combined with the above issues (local token access and remote package execution) it increases the potential blast radius if the fetched code or runtime steps are malicious.

What to consider before installing

This skill appears to be a local-publisher that expects a macOS runner and a one-time local Naver login, but the SKILL.md mentions several tokens/config entries that are not declared in the metadata. Before installing: 1) Ask the author for the source or homepage and for an explicit list of required env vars and config file formats. 2) Inspect the npm package @y80163442/naver-thin-runner source or release page — do not run npx blindly. 3) Verify whether the skill will actually require CONTROL_PLANE_URL/ACP_ADMIN_API_KEY (high-privilege) or will keep credentials strictly local. 4) If you must try it, run npx in a sandboxed environment and avoid providing global admin keys; keep user credentials on the local runner only. 5) Prefer a skill that declares its required env vars and provides an auditable install artifact (repository or release) rather than only npx instructions.

Publish prepared content to Naver Blog from an authenticated local browser on the buyer machine.

Best for:

• naver publish
• naver blog publish
• korean blog publish

First run:

• doctor -> setup -> dry_run -> login once -> live

Production support:

• macOS

Use when:

• a user already has final content and wants naver publish, naver blog publish, or korean blog publish
• an OpenClaw agent needs a reliable publish endpoint, not a writing/SEO ideation tool
• the buyer can run a local Mac runner and complete one-time Naver login

Do not use when:

• the user needs the post drafted from scratch
• the environment cannot run a local runner
• the task is only research, SEO planning, or topic ideation

Inputs:

• TITLE
• BODY
• optional TAGS
• optional PUBLISH_AT

Outputs:

• live publish: naver_publish_result
• preview: dry_run result with synthetic published_url
• readiness check: doctor/capabilities JSON

Recovery fields always expected on failure:

• error
• next_action
• setup_command
• login_command
• hint
• estimated_minutes

Runtime Config

• OPENCLAW_OFFERING_ID default naver-blog-writer
• SETUP_URL or PROOF_TOKEN + SETUP_ISSUE_URL
• OPENCLAW_OFFERING_EXECUTE_URL preferred
• fallback: CONTROL_PLANE_URL + ACP_ADMIN_API_KEY
• X_LOCAL_TOKEN optional and auto-loaded from ~/.config/naver-thin-runner/config.json
• LOCAL_DAEMON_PORT default 19090

Flow

1. doctor/capabilities
2. if RUNNER_NOT_READY, run setup
3. run publish_dry_run
4. if login_required=true, run one-time login before publish_live
5. publish_live

Commands

If the tool files are available, use them directly:

openclaw/skill-pack/naver-blog-writer/tools/doctor_capabilities
openclaw/skill-pack/naver-blog-writer/tools/publish_dry_run --title "Title" --body "Body" --tags "tag1,tag2"
openclaw/skill-pack/naver-blog-writer/tools/publish_live --title "Title" --body "Body" --tags "tag1,tag2"

One-time setup:

npx @y80163442/naver-thin-runner setup --setup-url "<SETUP_URL>" --auto-service both

Or proof-first:

npx @y80163442/naver-thin-runner setup \
  --proof-token "<PROOF_TOKEN>" \
  --setup-issue-url "<SETUP_ISSUE_URL>" \
  --auto-service both

One-time login:

npx @y80163442/naver-thin-runner login

Start local daemon if needed:

npx @y80163442/naver-thin-runner daemon start --port 19090

Common Failures

RUNNER_NOT_READY

• setup has not been completed on this Mac yet

AUTH_EXPIRED

• complete one-time Naver login again before the next live publish

LOCAL_DAEMON_DOWN

• start the local daemon and retry

UNSUPPORTED_PLATFORM

• production support is currently macOS

Billing

• publish_live is the paid path
• publish_dry_run is a preview path and should not create a billable live publish

Notes

• This product is a publisher, not a writer
• keep offering_id=naver-blog-writer for compatibility
• buyer credentials and session stay on the local runner machine
• advanced contract and schema docs live in docs/ACP_CONTRACT.md and docs/OFFERING_SCHEMA.md