Is c4chuan/csdn-publisher safe?
Yes. c4chuan/csdn-publisher is safe to install. Oathe's behavioral security audit gave the csdn-publisher skill by c4chuan a trust score of 87/100 with 4 findings, none critical or high.
https://github.com/openclaw/skills/tree/main/skills/c4chuan/csdn-publisher
Is c4chuan/csdn-publisher safe to install?
This appears to be a legitimate tool for publishing content to CSDN with appropriate browser automation functionality. While it has some elevated privileges and complex code execution capabilities, all functionality appears consistent with its stated purpose and no malicious behavior was detected.
What security issues were found in c4chuan/csdn-publisher?
Category Scores
Findings (4)
MEDIUM Sensitive file access during installation -15 ▶
The skill installation process accessed several sensitive files including SSH keys, AWS credentials, and environment files. While no exfiltration was detected, this creates potential attack surface.
MEDIUM Browser automation and CDP injection capabilities -20 ▶
The skill includes sophisticated browser automation using Playwright and Chrome DevTools Protocol for content injection. While legitimate for CSDN publishing, these capabilities could theoretically be misused.
LOW Canary file access without modification -10 ▶
Multiple canary files were accessed during installation, though no modifications or exfiltration was detected. This indicates the installation process had broad file system access.
LOW Complex documentation could obscure instructions -5 ▶
The skill contains extensive documentation (over 500 lines) which could potentially be used to hide malicious instructions, though none were detected in this analysis.
Should I install c4chuan/csdn-publisher?
Oathe's verdict for c4chuan/csdn-publisher is SAFE with a trust score of 87/100. Recommendation: Install with caution.