Skills/ClawHub/web-publisher

web-publisher@0.10.2

VERIFIED· install only

Publisher claims: "输入文章 URL **或本地文档（PDF/DOCX/PPTX/XLSX/EPUB/图片/音频/...）**，自动提取正文、可选 AI 改写、并发布到微信公众号；也可只把任意文档转成 Markdown 文本（不发布）。抓取 / 转换 / 改写 / 发布都在服务端 (tools.siping.me) 完成，CLI 不装任何 npm 依赖；登录、公众号配置全部通过对话 + 一次性浏览器跳转完成。⚠️ 服务端走云端固定 IP，**对小红书、部分知乎专栏、登录墙文章、海外站点经常被反爬挡掉**——此时由 AI Agent（Hermes / Cursor / OpenClaw 等）改调用**用户本地安装的 `news-to-markdown-skill`** 把 URL 抓成 Markdown，然后人工复核 / 归档。也可配合 `browser-web-search` 先搜索拿到 URL 再批量发布。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher sipingme · publishing for 67 daysInstalls 1,883Last detonated 7d ago
$clawhub install web-publisher
WatchReport an issue

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-07 and scored it 83/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

HIGH
Access to sensitive file pathsscripts/lib/credentials.js:180 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files...env,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Outbound HTTP to raw IP addressscripts/lib/endpoints.js:5 · Outbound HTTP to raw IP address — may bypass domain-based monitoringif (service === 'pipeline' && ['http://47.103.80.109:4000', 'http://101.133.167.31:4000'].includes(value)) value = BASES.pipeline[0];Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL using raw IP addressscripts/lib/endpoints.js:5 · URL using raw IP address — may bypass domain-based filteringif (service === 'pipeline' && ['http://47.103.80.109:4000', 'http://101.133.167.31:4000'].includes(value)) value = BASES.pipeline[0];Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Access to sensitive file pathsscripts/run.js:1525 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesprocess.stderr.write('\n[warn] 服务端未返回服务器 IP 列表（WECHAT_SERVER_IPS 可能没在 prod .env 里设置）；\n');Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05

Cost to the agent

Instructions loaded
≈7,785 tok
1 file · 13 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.