番茄小说创作发布一条龙技能。整合 open-novel-writing (AI创作) + fanqie-publisher (番茄发布)，从想法一键生成到发布到番茄小说。 完整流程：想法 → 设定 → 大纲 → 生成多章 → 评审修订 → 自动发布到番茄小说。
Security Analysis
medium confidenceThe skill broadly matches its claimed purpose (automating novel generation + publishing) but contains code/API inconsistencies and hides implicit credential/credential-file requirements that should be clarified before use.
The package claims to integrate open-novel-writing and fanqie-publisher to generate and publish novels, and most modules call or wrap those skills as expected. However, the top-level CLI (scripts/main.py) calls methods (e.g. check_fanqie_login, full_workflow, continue_workflow) that do not exist on AutoPublishWorkflow defined in scripts/auto_publish.py, indicating mismatched versions or an incomplete integration. That inconsistency suggests the shipped code may be broken or mixed from different releases.
SKILL.md and README show only expected usage (generate, convert, publish). The runtime instructions and included scripts perform only local file I/O (reading/writing under ~/.openclaw/skills and project dirs) and call into the fanqie-publisher skill. They do not attempt to read unrelated system configs or arbitrary environment variables. However the skill expects/uses an external cookie file (fanqie_cookies.json) and will import and call functions from another skill's main.py (dynamic import), which means runtime will execute code from the other skill—users should audit that other skill as well.
There is no install spec (instruction-only style), and the bundle contains Python scripts only. No external downloads or archive extraction are used. This is lower-risk from an install mechanism perspective, though the presence of executable scripts means they will run when invoked.
The skill declares no required environment variables, but it implicitly requires: (1) installed and configured fanqie-publisher and open-novel-writing skills, (2) a logged-in Fanqie account (cookie file path referenced: ~/.openclaw/skills/fanqie-publisher/scripts/fanqie_cookies.json), and (3) access to the novel-generator output and .learnings directories under ~/.openclaw. Those credentials/files are not declared or explained in SKILL.md, so the credential/access needs are under-documented and could surprise users.
The skill does not request always:true and does not modify other skills' configurations. It writes and reads files in its expected workspace under the user's home (~/.openclaw/skills/...), which is normal for this type of skill.
Guidance
What to consider before installing: - The code bundle largely does what the description says (generate → convert → publish), but there are clear code inconsistencies: scripts/main.py calls methods that don't exist in scripts/auto_publish.py (e.g., check_fanqie_login, full_workflow). This suggests the package may be a mismatched merge of different versions and could break at runtime. - The skill depends on two other skills (open-novel-writing and fanqie-publisher) and on a logged-in Fanqie author account. It expects a cookie file at ~/.openclaw/skills/fanqie-publisher/scripts/fanqie_cookies.json and reads/writes files under ~/.openclaw/skills/... but does not declare these credential/file requirements in the manifest. Before installing, ensure you trust and audit the fanqie-publisher skill (network and auth behavior) because this skill will import and execute its main.py functions. - There are no remote downloads in the install, but the code will execute local Python scripts and call subprocess to run the fanqie-publisher login; run it in a sandbox or test environment first, and back up any important cookie/auth files. - Recommended actions: (1) ask the maintainer for a corrected release or version which aligns main.py and auto_publish.py; (2) inspect the fanqie-publisher main.py to confirm where credentials are stored and whether network endpoints are expected; (3) test the workflow with a throwaway Fanqie account; (4) only provide real credentials after you verify the other skill’s behavior. If you cannot verify those points, treat the skill as untrusted.
Latest Release
v1.0.3
fanqie-novel-auto-publish 1.0.3 - 增加了企业开发·定制技能的微信联系方式至文档底部 - 其他内容未做变更
More by @chenjiahui11
Published by @chenjiahui11 on ClawHub
