The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell commands (curl, ls) and a Python automation script (scripts/publish.py) to manage the Douyin creator platform and verify environment readiness.
[DATA_EXFILTRATION]: The automation script accesses and stores sensitive session data, including cookies and local storage tokens, in the local directory ~/.douyin_cookies/storage_state.json. While necessary for browser automation persistence, this exposes authentication credentials on the filesystem.
[INDIRECT_PROMPT_INJECTION]: The skill ingests content from external markdown and text files located in /home/aa/clawd/docs/daily-content/ to populate social media posts.
Ingestion points: The _parse_daily_content function in scripts/publish.py reads data from local files provided via the --source argument.
Boundary markers: The skill lacks explicit boundary markers or instructions to ignore embedded commands within the ingested content.
Capability inventory: The skill uses Playwright to navigate, click, and type into a social media platform, providing a significant interaction surface.
Sanitization: The script performs basic length checks but does not sanitize content against malicious payloads that could interfere with the browser automation logic.
[DYNAMIC_EXECUTION]: The script utilizes page.evaluate() to execute JavaScript within the browser context. This is a powerful mechanism used to interact with the React-based UI of the creator platform where standard selectors may be unstable.
[EXTERNAL_DOWNLOADS]: The skill instructions require the installation of the Playwright library and browser binaries from official sources (pip install playwright && playwright install chromium). These are well-known services and are considered safe under standard usage.

douyin-smart-publish