Openclaw
Security checks across static analysis, malware telemetry, and agentic risk
Overview
This is an instruction-only PostHero client that is internally consistent: it only requests a single POSTHERO_API_KEY credential and its runtime instructions call the PostHero API to manage social posts — no unrelated permissions, installs, or file access are requested.
This skill appears coherent, but treat your POSTHERO_API_KEY like any API secret: only provide a key you obtained from the official PostHero site, confirm the base URL (server.posthero.ai) matches PostHero's documentation, and ensure the key's permissions are limited (and can be revoked). Be aware that anyone with this key and access to the agent can create or publish posts on your connected social accounts — consider using a key with constrained scope or rotating it if the agent is shared. If you have concerns, verify the integration on PostHero's dashboard and monitor account activity after enabling the skill.
SkillSpector
SkillSpector findings are pending for this release.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal findings are pending for this skill version.