ClawHub

Social Media Assistant via PostHero

v1.0.1

Schedule and publish social media posts across LinkedIn, Twitter/X, Instagram, Facebook, YouTube, TikTok, Threads, and Bluesky using the PostHero API. Create...

⭐ 1· 60·0 current·0 all-time
by@a007mr
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
The name/description (PostHero social-media manager) match the declared requirement (POSTHERO_API_KEY) and the SKILL.md describes only PostHero API calls for account listing, posting, scheduling, media uploads, and analytics. No unrelated services, binaries, or config paths are requested.
ℹ
Instruction Scope
SKILL.md contains concrete instructions to call PostHero endpoints (GET /accounts, POST /posts, GET /posts, analytics). It does not instruct reading local files or unrelated env vars. One operational note: the skill allows publishing immediately (publishNow: true); the agent could post on behalf of the user if allowed to act without explicit confirmation, so consider requiring explicit user confirmation before publishing.
✓
Install Mechanism
Instruction-only skill with no install spec and no code files. This is the lowest-risk install profile — nothing is downloaded or written to disk by an installer.
ℹ
Credentials
Only POSTHERO_API_KEY is required, which is appropriate. However, that single API key likely grants the ability to list connected accounts, create/schedule/publish posts, upload media, and read analytics; ensure the key's scope and lifetime are limited to the minimal permissions needed (e.g., read-only vs. posting) and prefer short-lived or revokable keys.
✓
Persistence & Privilege
The skill is not always-enabled and does not request system-level persistence. It is user-invocable and allows normal autonomous invocation (platform default). Because it can perform actions that change external state (publish posts), consider restricting autonomous publishing or requiring explicit user confirmation in conversational flow.
Assessment
This skill appears to do what it claims: it uses a single POSTHERO_API_KEY to call PostHero's API to list accounts, create/schedule/publish posts, upload media, and fetch analytics. Before installing: (1) Verify the API base URL (SKILL.md uses server.posthero.ai) matches PostHero's documented API or your expectations. (2) Create an API key with the least privilege needed (if you only want analytics, don't grant posting rights). (3) Prefer short-lived or revocable keys. (4) Consider limiting the skill so it must ask you to confirm any publishNow action (to avoid accidental/unwanted posts). (5) Only install if you trust PostHero and the provided homepage/contact details.

Like a lobster shell, security has layers — review code before you run it.

latestvk97c44968m07dpc14z11eezb4x84nq8d

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🦸 Clawdis
EnvPOSTHERO_API_KEY
Primary envPOSTHERO_API_KEY

Comments