📦 toutiaoAutoPublish — 技能工具
v1.0.0今日头条微头条自动发布工具。自动发布短内容到今日头条平台，支持文本和图片。 使用场景：(1) 用户说"发布头条"、"发微头条"、"头条发布"时触发 (2) 需要自动发布社交媒体内容时 (3) 需要定时发布今日头条时
0· 636·4 当前·4 累计
by 安全扫描
OpenClaw
可疑
medium confidenceThe skill largely matches its stated purpose (automating Toutiao posts) but contains surprising/incoherent elements (mismatched debugging port, a built-in default message that will post autonomously, and truncated code review uncertainty) that warrant caution before use.
评估建议
What to consider before installing/using this skill:
- Inconsistent instructions: SKILL.md tells you to start Chrome with --remote-debugging-port=9222, but the script attempts to connect to CDP at http://localhost:18800. Confirm which port the script expects and update either the script or your Chrome startup command. If you run it with 9222 and the script still tries 18800, it will fail to connect.
- Default autopost content: The script contains a built-in DEFAULT_CONTENT that will be posted ...详细分析 ▾
⚠ 用途与能力
The skill's name/description (auto-publish to 今日头条) aligns with the included Playwright-based script that automates a logged-in local Chrome. However there are unexpected elements: the script contains a DEFAULT_CONTENT that would be posted if no content is provided (it self-describes an AI 'exploration' post), which is not called out in SKILL.md. Also the script attempts to connect to a CDP at http://localhost:18800 while the SKILL.md tells the user to start Chrome with --remote-debugging-port=9222 — this mismatch is incoherent and could lead to unexpected behavior.
⚠ 指令范围
SKILL.md directs the agent/user to start Chrome with remote debugging (port 9222), install Playwright, and run the Python script. The script (visible portion) reads local files (images, content file), reuses browser login state, and takes screenshots to ~/Desktop — these actions are within the domain of an automated publisher. Concerns: (1) SKILL.md does not warn that if no content is provided the script will publish a built-in message referencing an autonomous 'OpenClaw' AI (potentially posting without explicit user-provided text). (2) SKILL.md and code disagree on the CDP port (9222 vs 18800). (3) The file was truncated in the review; the remainder should be checked for any external network calls, hidden telemetry, or data exfiltration logic (none obvious in the shown portion).
✓ 安装机制
This is instruction-only with no install spec; SKILL.md asks users to pip install playwright and run playwright install chromium, which is reasonable for a Playwright-based script. No remote downloads or archive extracts are declared in the skill bundle itself.
✓ 凭证需求
The skill requests no environment variables or external credentials in the registry metadata. It relies on the user's local logged-in Chrome session to authenticate — appropriate for a tool that reuses browser login state. The script accesses local files (content, image) and writes screenshots to the Desktop, which fits the stated purpose.
✓ 持久化与权限
always is false and the skill does not request elevated platform privileges in the manifest. It runs locally and does not declare any automatic permanent presence or modifications to other skills. Autonomous invocation is allowed by platform default but is not combined here with broad credentials.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/10
publish jinri toutiao news use browser agent
● 无害
安装命令
点击复制官方npx clawhub@latest install toutiao-auto-publish
镜像加速npx clawhub@latest install toutiao-auto-publish --registry https://cn.longxiaskill.com
技能文档
使用此 skill 可以自动发布微头条到今日头条平台。
前置要求
- Chrome 远程调试已启动：
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --remote-debugging-port=9222
- Chrome 已登录今日头条：访问 https://mp.toutiao.com 完成登录
- Python 依赖：
pip3 install playwright --break-system-packages
playwright install chromium
使用方法
基本发布
cd ~/.openclaw/workspace/skills/toutiao-publisher/scripts
python3 toutiao_publish.py "要发布的文字内容"
带话题发布
# 单个话题 python3 toutiao_publish.py "内容文字" --topic "#AI#"
# 多个话题 python3 toutiao_publish.py "内容文字" --topic "#AI#,#OpenClaw#,#科技#"
带图片发布
python3 toutiao_publish.py "内容" --image /path/to/image.jpg
从文件读取内容
python3 toutiao_publish.py -f content.txt
参数说明
| 参数 | 说明 | 示例 |
|---|---|---|
| content | 发布内容 | "今天天气很好" |
| -f, --file | 从文件读取 | -f post.txt |
| -i, --image | 图片路径 | --image pic.jpg |
| -t, --topic | 话题标签，多个用逗号分隔 | --topic "#AI#,#OpenClaw#" |
| --headless | 无头模式 | --headless |
| --no-wait | 不等待登录 | --no-wait |
话题格式
话题必须使用 双 # 格式：
- ✅ 正确：
#AI#、#OpenClaw#、#科技前沿# - ❌ 错误：
#AI、AI#
多个话题用逗号分隔，脚本会自动用空格连接。
输出
- 成功截图：
~/Desktop/toutiao_publish_success.png - 错误截图：
~/Desktop/toutiao_error.png
故障排除
| 问题 | 解决方案 |
|---|---|
| 无法连接 Chrome | 确保 Chrome 已启动并开启 9222 端口 |
| 未检测到登录 | 在 Chrome 中访问 mp.toutiao.com 完成登录 |
| 发布失败 | 检查网络连接，查看错误截图 |