Social Media Assistant (via postsyncer.com)

Manages social media through PostSyncer using MCP tools. Use when scheduling, posting, or managing content across Instagram, TikTok, YouTube, X (Twitter), Li...

Security Scan

The skill's requests and runtime instructions line up with its stated purpose: it only asks for a PostSyncer API token and instructs the agent to call PostSyncer/MCP endpoints to manage social posts and analytics.

Purpose & Capability

Name, description, and SKILL.md all describe social-media management via PostSyncer; the only required credential (POSTSYNCER_API_TOKEN) and the listed endpoints (app.postsyncer.com, postsyncer.com/mcp, docs.postsyncer.com) are directly related to that purpose.

Instruction Scope

SKILL.md confines runtime instructions to PostSyncer MCP operations (list-workspaces, list-accounts, create-post, comments, analytics, etc.). It does not instruct the agent to read unrelated files, scan the local system, or exfiltrate data to other endpoints beyond PostSyncer.

Install Mechanism

This is an instruction-only skill with no install spec or code files, so nothing is written to disk or downloaded during install.

Credentials

Only one environment variable (POSTSYNCER_API_TOKEN) is required and it is the expected credential for the service. The SKILL.md references no other secrets or unrelated credentials.

Persistence & Privilege

The skill is not always-enabled (always:false). Model invocation is allowed (default) which is normal for skills; be aware that allowing autonomous invocation gives the agent the ability to call PostSyncer APIs without interactive approval unless the agent's authorization rules prevent that.

Assessment

This skill appears coherent, but the POSTSYNCER_API_TOKEN grants access to your PostSyncer workspaces/accounts/posts so treat it like a sensitive credential: create a personal access token with minimal scopes, rotate it if compromised, and test actions using drafts or a staging workspace first. Confirm destructive operations (delete-account, delete-post, delete-comment) before allowing the agent to run them. Review PostSyncer's privacy/terms and ensure accounts are pre-connected as the SKILL.md requires. If you require tighter control, restrict the agent's ability to invoke the skill autonomously or require user confirmation for publish/delete actions.

PostSyncer Social Media Assistant

Autonomously manage social media through PostSyncer using MCP tools.

Setup

1. Create a PostSyncer account at app.postsyncer.com
2. Connect social profiles (Instagram, TikTok, YouTube, X, LinkedIn, etc.)
3. Go to Settings → API Integrations and create a personal access token with abilities: workspaces, accounts, posts
4. Add to .env: POSTSYNCER_API_TOKEN=your_token
5. Configure OpenClaw MCP server: URL https://postsyncer.com/mcp, header Authorization: Bearer <POSTSYNCER_API_TOKEN>

MCP Tools Reference

All operations use these MCP tools. Arguments accept snake_case or camelCase.

Discovery (Call First)

list-workspaces - Get all workspaces and their IDs

• No parameters required
• Returns: workspaces with id, name, and connected accounts

list-accounts - Get all connected social accounts

• No parameters required
• Returns: accounts with id, platform, username, workspace_id

Posts

create-post - Schedule or publish content

{
  "workspace_id": 12,
  "schedule_type": "schedule",
  "content": [{"text": "Caption #hashtags", "media": ["https://example.com/image.jpg"]}],
  "accounts": [{"id": 136}, {"id": 95, "settings": {"board_id": 123}}],
  "schedule_for": {"date": "2026-03-26", "time": "14:30", "timezone": "America/New_York"},
  "labels": [5],
  "campaign_id": null,
  "repeatable": false,
  "repeatable_times": null,
  "repeatable_gap": null,
  "repeatable_gap_unit": "days"
}

• schedule_type: publish_now | schedule | draft
• schedule_for: Required for schedule. Date format Y-m-d, time H:i
• content: Array of thread items. Each needs text and/or media (public HTTPS URLs)
• accounts: Array of {id, settings?}. Platform-specific options in settings

list-posts - Browse posts with pagination

{"per_page": 50, "page": 1, "include_comments": false}

get-post - Get single post details

{"id": 123}

update-post - Modify scheduled/draft posts

{"id": 123, "content": [{"text": "Updated caption"}], "schedule_for": {...}}

delete-post - Remove a post (confirm with user first)

{"id": 123}

Comments

sync-comments-from-platforms - Refresh comments from social networks

{"post_id": 123}

list-comments - View comments on a post

{"post_id": 123}

create-comment - Reply to a post or comment

{
  "post_id": 123,
  "content": "Reply text",
  "parent_comment_id": null,
  "media_urls": []
}

hide-comment - Hide a comment from public view

{"id": 456}

delete-comment - Permanently remove a comment (confirm first)

{"id": 456}

Labels & Campaigns

list-labels | create-label | update-label | delete-label

• Use workspace-scoped IDs only

list-campaigns | create-campaign | update-campaign | delete-campaign

• Campaigns group related posts

Analytics

get-analytics-summary - Overview across all workspaces

get-analytics-workspace - Per-workspace metrics

{"workspace_id": 12}

get-analytics-post - Single post performance

{"post_id": 123}

get-analytics-account - Per-account metrics

{"account_id": 136}

sync-post-analytics - Refresh stale metrics

{"post_id": 123}

Account Management

delete-account - Disconnect a social profile (destructive, confirm first)

{"id": 136}

Common Workflows

Schedule a Post to Multiple Platforms

1. list-workspaces → get workspace_id
2. list-accounts → get ids for target platforms
3. create-post with schedule_type: "schedule" and schedule_for

Reply to Comments Across Platforms

1. list-posts → find post id
2. sync-comments-from-platforms for that post
3. list-comments → view comments
4. create-comment with post_id and optional parent_comment_id for replies

Check Performance & Refresh Data

1. get-analytics-post for specific post
2. If stale: sync-post-analytics then check again

Platform-Specific Settings

Pass per-platform options in accounts[].settings:

Pinterest: {"board_id": 123456} X/Twitter: {"reply_to_tweet_id": "...", "quote_tweet_id": "..."} TikTok: {"allow_comments": true, "allow_duet": false, "allow_stitch": true}

See API docs for complete settings reference.

Best Practices

• Always start with list-workspaces and list-accounts to get IDs
• New automations: Use schedule_type: "draft" or confirm before publish_now
• Destructive actions: State what will happen, then confirm before delete-post, delete-account, delete-comment
• Multi-network: One post can target multiple accounts; check per-platform status in response
• Rate limits: Respect analytics sync limits; don't call sync-* repeatedly
• Hashtags: Keep relevant and limited (3-5 per post)

Error Handling

• 401/403: Token invalid or missing required abilities
• 404: Resource not found or no access
• 422: Validation error—check required fields and formats
• 429: Rate limited—wait before retrying

Links

• MCP Tools Reference
• API Documentation
• PostSyncer Dashboard