📦 📰 ZeeLin Report-to-X AutoPost — 自动推文
v1.5.0自动抓取报告网站或 JSON 源中最新未发布报告，生成英文摘要并一键发布到 X/Twitter，实现内容营销自动化。
0· 156·0 当前·0 累计
by @kelcey2023下载技能包
最后更新
2026/4/4
安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
This skill's high-level behavior is reasonable, but before installing you should: (1) inspect the referenced tweet.sh at ~/.openclaw/workspace/skills/zeelin-twitter-web-autopost/scripts/tweet.sh to confirm what it does (it will run with your permissions and may access browser cookies or network); (2) edit the Python script so REPORT_SITE and the tweet script path are configurable (not hard-coded) and so source-selection matches the SKILL.md if you need RSS/JSON support; (3) verify you trust the ...详细分析 ▾
⚠ 用途与能力
The SKILL.md promises flexible data-source handling (reports_config.json, RSS, JSON, SPA JS) and to reuse an existing web-posting script; the included Python only scrapes one hard-coded REPORT_SITE and does not implement flexible source discovery. It also hard-codes a path to another skill's tweet.sh, which is not declared as a dependency.
⚠ 指令范围
The runtime instructions and SKILL.md describe safe-to-follow steps, but the shipped code executes an external script at a fixed path (~/.openclaw/workspace/skills/zeelin-twitter-web-autopost/scripts/tweet.sh). Invoking that script hands over execution to code outside this skill's manifest and could transmit data or perform actions not described in SKILL.md. The script also writes state to the user's home (~/.openclaw/memory/...), which is expected but worth noting.
✓ 安装机制
No install spec and only a small Python script are included; nothing is downloaded or extracted. This lowers install-time risk.
⚠ 凭证需求
The skill requests no env vars, but it accesses and creates files under the user's home (~/.openclaw/...), and it calls a script in another skill's workspace. That cross-skill path access is disproportionate unless the user explicitly expects and trusts the referenced tweet.sh implementation and its use of browser cookies or other credentials.
⚠ 持久化与权限
always is false (good), but the skill persists posted IDs to ~/.openclaw/memory/zeelin_last_report.json. More importantly, it invokes a script belonging to a different skill workspace, which effectively grants that other script runtime privilege from this skill's invocation and can broaden the blast radius unexpectedly.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.5.02026/3/24
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install zeelin-report-to-x-autopost
镜像加速npx clawhub@latest install zeelin-report-to-x-autopost --registry https://cn.longxiaskill.com