content-matrix-publisher

This skill implements a plausible multi-platform publishing workflow but its metadata is inconsistent with its runtime needs. Before installing or enabling it: - Expect to provide sensitive credentials (xiaohongshu web_session cookie, WeChat appid/secret) in your ~/.openclaw/config.yaml — do not store secrets you are not comfortable exposing. The skill metadata does not declare these requirements, so you must add them manually. - The scripts call other CLIs/skills (agent-reach, xiaohongshu-mcp, wechat-article-pro) and use jq; ensure you only install trusted implementations of those tools. Verify the xiaohongshu/wechat publisher CLIs are legitimate and review their code/config handling. - By default publish.sh runs in DRY RUN mode; test thoroughly in dry-run before enabling auto_publish. - Scheduled and webhook triggers exist; keep auto_publish disabled unless you want unattended publishing. If you enable scheduling or webhooks, review what network endpoints and credentials will be used and whether the webhook exposes a public endpoint. - Because the package doesn’t declare required env vars or binaries, inspect and validate the config files and scripts yourself (especially where credentials are read/stored) and consider running in an isolated/test environment first. If you want more confidence, ask the skill author to: (1) declare required credentials and binaries in metadata, (2) avoid storing raw cookies/app secrets in plain config or provide clear guidance about secure storage, and (3) confirm which external CLIs/skills are required and where they come from.