weibo — read & post on 微博 via your own cookies

Drives the user's real 微博 account through the same weibo.com/ajax web API the site uses, authenticated by the login cookie they captured with the ACE extension. No browser, no third-party deps — just urllib.

⚠️ Not yet E2E-verified. Unlike the other cookie skills (csdn / juejin / bilibili / medium), this one was built from the documented web API but could not be tested against a live account (no 微博 connection existed at build time). The first live run is the verification; if an endpoint shape drifted it will surface as a clear error rather than silent breakage.

The connector injects the cookie jar as an env var:

• WEIBO_COOKIES — a JSON array of cookies. Secret — never echo or print it. Writes send the XSRF-TOKEN cookie as both the x-xsrf-token header and the st form field (the CLI does this for you).

CLI

The skill ships scripts/weibo.py — self-contained, stdlib only.

# $SKILL_DIR can point at another skill loaded this turn — anchor on our own
# script, and re-run this at the top of every Bash block (fresh shell each time).
WB="$SKILL_DIR/scripts/weibo.py"; [ -f "$WB" ] || WB=$(find /tmp -maxdepth 8 -path '*/skills/*/scripts/weibo.py' 2>/dev/null | head -1)
[ -f "$WB" ] || { echo "weibo script not found (SKILL_DIR=$SKILL_DIR)" >&2; exit 1; }
python3 "$WB" whoami                     # who is logged in (+ counts)
python3 "$WB" posts --limit 20           # my recent 微博 + engagement

Engagement comes straight from 微博: reposts_count (转发), comments_count (评论), attitudes_count (赞).

Verify the connection first

WB="$SKILL_DIR/scripts/weibo.py"; [ -f "$WB" ] || WB=$(find /tmp -maxdepth 8 -path '*/skills/*/scripts/weibo.py' 2>/dev/null | head -1)
python3 "$WB" whoami
# → {"uid": "...", "name": "...", "statuses_count": ...}

On an auth error the cookie is expired — have the user reconnect at https://studio.acedata.cloud/console/connectors. Do not loop-retry.

Posting — GATED (dry-run unless trailing --confirm)

微博 are short-form, so there is no draft step — a confirmed post goes live. Without a trailing --confirm it dry-runs. --confirm is honored only as the last argument. Always show the dry-run, get an explicit "yes", then re-run.

WB="$SKILL_DIR/scripts/weibo.py"; [ -f "$WB" ] || WB=$(find /tmp -maxdepth 8 -path '*/skills/*/scripts/weibo.py' 2>/dev/null | head -1)
python3 "$WB" post --content "你好，这是一条微博"            # dry-run
python3 "$WB" post --content "你好，这是一条微博" --confirm   # PUBLIC 微博 (immediate)

• There is no draft and no private mode on 微博 — a confirmed post is immediately public. Always show the dry-run and get explicit approval of the exact text before adding --confirm.

Gotchas

• This is the user's real 微博 account. Confirm before any post — it is immediate and public by default.
• Not E2E-verified (see the warning above) — expect to validate the first run.
• Never print WEIBO_COOKIES — it is full account access.
• ToS: acts only on the user's own account with their own captured cookie.