首页龙虾技能列表 › SeedDrop — 社区互动助手

SeedDrop — 社区互动助手

v1.0.4

社区互动助手,监控多平台讨论,生成有价值回复草稿,需人工审核后发送。支持B站、贴吧、知乎、小红书等,确保回复提供真实价值,品牌提及自然且受控。

0· 186·0 当前·0 累计
by @2019-02-18 (LIU)·MIT-0
下载技能包
License
MIT-0
最后更新
2026/4/11
安全扫描
VirusTotal
无害
查看报告
OpenClaw
可疑
high confidence
代码和运行指令主要符合社区互动机器人,但存在显著不一致和敏感要求(SocialVault + 全会话Cookie + 浏览器自动化),增加了风险,安装前应审查。
评估建议
["安装前考虑事项:","- 元数据不匹配:注册表项声称无必需二进制文件/凭证,但包和SKILL.md需要Node/npx/tsx、无头浏览器工具和SocialVault伴侣技能。不要相信'none'元数据——确认您有所需的运行时和伴侣技能。","- 敏感凭证:技能需要平台的全会话Cookie(例如BDUSS、z_c0、d_c0、SESSDATA)。这些Cookie可以用于模拟您的账户。技能预计您将它们存储在SocialVault(加密)并导出/注入到浏览器中。仅在完全信任SocialVault和此技能的代码时才继续。","- 审查代码和适配器:包中包含许多脚本和每平台适配器。如果您不舒适自行审计,请请求独立代码审查(注意适配器和它们所做的任何网络调用)。寻找隐藏的远程端点、遥测或命令以泄露秘密。","- 首先在安全环境中运行:使用假账户和非生产凭证进行测试。首选最小权限凭证和无付款方法绑定的账户。","- 验证SocialVault:确认SocialVault技能是官方/预期实现,并了解如何向代理导出凭证。验证加密和访问控制。","- 本技能强制手动审批,降低滥用风险,但手动审查仅保...
详细分析 ▾
用途与能力
The skill's purpose (monitoring and drafting replies) matches the included scripts (monitor, scorer, responder, auth-bridge, adapters). HOWEVER the registry metadata claims no required binaries/credentials while the package manifests and SKILL.md clearly require node/npx/tsx, a headless browser tool, and a companion SocialVault skill. That metadata mismatch is incoherent and could mislead users about necessary privileges and dependencies.
指令范围
The SKILL.md and scripts instruct the agent to: obtain sensitive cookies from SocialVault, inject complete cookies into a headless browser, navigate and scrape/render pages, and run local TypeScript scripts via `npx tsx`. These actions are within the stated purpose but involve handling full session cookies (e.g., z_c0, d_c0, BDUSS) which can enable account actions or takeover if mishandled. The instructions also delegate SocialVault operations to the agent (auth-bridge returns run-this-command tokens), meaning the agent will be asked to execute commands that access encrypted credentials—this is expected for the feature but high-risk.
安装机制
There is no install spec in the registry entry, but the package contains many TypeScript scripts and a clawhub.json that declares required tools (bash, browser) and anyBins (node, npx). Running the skill requires executing local code via `npx tsx`. The absence of an explicit install step combined with executable source files means code will be run locally at runtime—verify the code and required runtime (Node/tsx) before running. No third-party download URLs were present, which reduces some installation risk.
凭证需求
The skill requests no environment variables in registry metadata, but the runtime explicitly requires access to user session cookies for multiple platforms (SESSDATA/bili_jct, BDUSS/STOKEN, z_c0/d_c0/__zse_ck/_xsrf/SESSIONID, a1/web_session). These are highly sensitive credentials. The reliance on a separate SocialVault companion for encrypted storage is appropriate for secrecy, but the agent is instructed to export and inject full cookies into a browser context—this is proportional to automated posting but materially increases credential exposure and should only be granted if you trust both SocialVault and this skill's code.
持久化与权限
The skill is not force-enabled (always: false) and uses normal autonomous invocation. It persists only to its own memory files under {baseDir}/memory (brand-profile.md, interaction-log.jsonl, performance-stats.json), and does not request system-wide configuration changes. This level of persistence is expected for its function.
安全有层次,运行前请审查代码。

License

MIT-0

可自由使用、修改和再分发,无需署名。

运行时依赖

无特殊依赖

版本

latestv1.0.42026/3/17

SeedDrop 1.0.4 更新日志 - 添加了35个新文件,包括适配器、脚本、指南、内存和参考,以支持核心功能。 - 平台监控现在具有反检测回退:如果贴吧或知乎API搜索返回无结果(被阻止),它会自动切换到使用存储的Cookie的浏览器搜索。 - 更新了监控逻辑:适配器包括浏览器搜索方法,并提供了详细的浏览器自动化指南。 - 在SKILL.md中增强了浏览器搜索程序、所需Cookie和回退触发器的文档。 - 安全性和工作流规则仍然强制执行:需要SocialVault,无明文凭证存储,只允许手动回复批准。

● 无害

安装命令 点击复制

官方npx clawhub@latest install seed-drop
镜像加速npx clawhub@latest install seed-drop --registry https://cn.clawhub-mirror.com

技能文档

您是SeedDrop,一名社区互动专家。您的任务是帮助小型企业和独立开发者通过提供真正有价值的回复(自然提及他们的产品或服务)参与在线讨论。 核心原则:每个回复必须首先提供真实价值。品牌提及是次要的,必须不超过回复内容的20%。 ... (由于字符限制,完整的cn_skill_md_content未全部显示,但应按照规则保留所有原始Markdown内容不翻译,仅翻译非代码、非命令部分)

数据来源:ClawHub ↗ · 中文优化:龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制

免费技能或插件可能存在安全风险,如需更匹配、更安全的方案,建议联系付费定制

了解定制服务