Short Drama Publisher
WarnAudited by ClawScan on May 10, 2026.
Overview
This skill asks for browser session cookies and persistent automation to publish to Facebook, but the runnable publishing scripts are not included for review.
Review carefully before installing or using. Do not provide Facebook or MoboBoost cookies until the actual scripts are available and audited, use dedicated accounts if testing, disable scheduled cron automation unless explicitly needed, require approval before every post, and ensure you have rights to publish the downloaded content.
Findings (5)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If those cookie files are mishandled or used by unreviewed code, someone or something could act as the user's MoboBoost or Facebook session.
The skill requests raw browser session cookies for two services. These can grant broad account access and are not reflected in the registry credential declarations.
MOBOBOOST_COOKIES: "MoboBoost login cookies (JSON format, exported from browser)" FACEBOOK_COOKIES: "Facebook login cookies (JSON format, exported from browser)"
Avoid using personal accounts; prefer scoped OAuth/API tokens where possible, use dedicated test accounts, store cookies securely, and do not provide cookies until the actual code has been reviewed.
The agent or referenced scripts could publish unwanted or incorrect videos to Facebook under the user's account.
The workflow includes automated public posting, but the artifact does not define a required human confirmation step, target page/account scope, content preview, or reversal process.
📤 Auto-publish to Facebook
Require explicit per-post approval, show the final video and caption before upload, document the exact Facebook destination, and provide a dry-run mode and deletion/rollback guidance.
The workflow could continue posting on a schedule after the user forgets about it or after cookies/accounts change state.
The documented cron job enables ongoing background execution of the full workflow, including downloads and Facebook posting.
0 9 * * * cd /path/to/short-drama-publisher && python scripts/daily_workflow.py >> logs/cron.log 2>&1
Do not enable the cron job unless ongoing automation is intended; add clear stop/uninstall instructions, logging review, rate limits, and a confirmation gate before publishing.
A user would need to obtain or create unreviewed scripts to run the advertised workflow, which is risky because those scripts would receive account cookies and publish publicly.
SKILL.md describes required helper scripts, but the supplied manifest contains only SKILL.md and no code files. The high-impact automation code is therefore not available for review.
├── scripts/ │ ├── moboboost_downloader.py │ ├── facebook_publisher.py │ └── daily_workflow.py
Publish the referenced scripts in the reviewed artifact set, pin dependencies, document provenance, and ensure credential handling and posting behavior can be audited.
The workflow may create social-media activity that appears less automated than it really is, potentially affecting account reputation or platform compliance.
The wording suggests making automated posting appear organic, which is a trust and platform-integrity concern when paired with cookie-based Facebook automation.
Recommend 1-3 videos per day to simulate organic posting rhythm
Use transparent scheduling language, comply with Facebook policies, and avoid instructions that disguise automation as human activity.