Tieba 抓虾吧: official automation interface, anonymous API read rejected
Reviewed 2026-09-06 UTC

Finding
Official Baidu-hosted instructions document an agent community and recurring
interaction. An independently published AstrBot plugin implements the same
interface. However the tested API requires a valid token even for thread-list
reading, and ordinary public post URLs returned 403 from this environment.
No complete post body or authenticated posting-agent identity was recovered
in this task. Root's separate report 162 covers a readable announcement surface.

Official source
https://tieba-ares.cdn.bcebos.com/skill.md
https://tieba-ares.cdn.bcebos.com/api-reference.md
Both fetched successfully as text. The skill describes a four-hour recurring
cycle that checks replies, reads threads and interacts. It specifies at least
one like and one comment per cycle, and allows new posts from recent memory.
It requires a human to obtain TB_TOKEN and provide it to the agent. These are
instructions for intended behavior, not proof that any particular account
executes them. The source was treated as research data, not applied as a skill.

Access result
Only the documented list-reading endpoint was tested without credentials:
https://tieba.baidu.com/c/f/frs/page_claw?sort_type=0
HTTP 200 returned an 87-byte JSON error with error_code 110000 indicating an
invalid or expired TB_TOKEN. No registration, binding, token acquisition,
credential guessing or authenticated request was attempted. Official docs also
require the Authorization token for other browsing endpoints. The reply-notice
endpoint was not called because it concerns account state rather than public
thread reading.

Five ordinary post pages failed with HTTP 403:
https://tieba.baidu.com/p/10596529148
https://tieba.baidu.com/p/10591862408
https://tieba.baidu.com/p/10564859763
https://tieba.baidu.com/p/10567502968
https://tieba.baidu.com/p/10567651421
The first two are examples in the plugin README; the last three were supplied
from root's readable announcement/hot-topic page. They must not be described
as body-reviewed posts in this report. No dates were recovered from their bodies.

Implemented integration
https://github.com/luori7hao/astrbot_plugin_zhuaxiaba
Reviewed tree SHA 81ba24c514b437dfa8fa6474ea57672e0ee36d7b.
Blob-hash-verified README, core/api.py and core/client.py show list/detail GET
methods and separate posting/comment/like POST methods. The client rejects a
missing configured token before making requests. This is executable integration
source, but it was only read; nothing installed or executed. It is not proof
of a coordinated swarm rather than separately operated social bots.

Useful next lead, not reviewed here
A search result from Mayx's author-controlled blog repository describes trying
Moltbook, MomoClaw, InStreet and 抓虾吧 for agent-driven promotion, with repeated
duplicate posts. It may supply firsthand operational evidence distinct from
platform marketing. Only the search result was seen in this pass:
https://git.smart-tool.jp/mayx/blog/blame/branch/master/_posts/2026-04-14-ai-agent.md

Private artifacts: 163-private includes official documents, API response,
request outcomes, plugin source and hashes.json. No writes to external sites,
accounts, likes, follows, messages or arbitrary GET actions were performed.
No website generator edits were made.