Typefully Skill
v1.0.0Create, schedule, list, edit, and delete drafts on Typefully. Supports single tweets, threads, and multi-platform posts (X, LinkedIn, Threads, Bluesky, Masto...
⭐ 0· 342·0 current·0 all-time
bychapati@chapati23
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (Typefully drafts) match the included script and SKILL.md: the script exclusively calls the Typefully v2 API (https://api.typefully.com/v2) to list/create/edit/schedule/delete drafts. The only credentials used are a Typefully API key and an optional social-set id. No unrelated services or privileges are requested.
Instruction Scope
SKILL.md instructs the agent to use the included bash script which reads TYPEFULLY_API_KEY (or fallback to pass), uses curl to contact the Typefully API, and uses python3 for JSON escaping. It does not instruct reading arbitrary system files or sending data to other endpoints. The only optional data source is the Unix password store (pass).
Install Mechanism
There is no install spec (instruction-only skill with an included script), so nothing is downloaded at install time. The script is included in the package and runs locally. This is a low-risk install model.
Credentials
The runtime needs only TYPEFULLY_API_KEY (required) and optionally TYPEFULLY_SOCIAL_SET_ID or entries in pass. That is proportional to the function. Note: the registry metadata listed no required env vars, whereas SKILL.md and the script clearly require TYPEFULLY_API_KEY (and optionally use pass). This mismatch is an administrative inconsistency but not a functional red flag.
Persistence & Privilege
The skill does not request always:true, does not modify other skills or global agent settings, and requires no persistent system privileges. Autonomous invocation is allowed by default (normal) but the skill’s actions are limited to the Typefully API and local pass lookup.
Assessment
This skill appears to do what it says: it will make API calls to api.typefully.com using a Typefully API key you provide. Before installing: (1) Verify you trust the skill source (homepage repo) and inspect the included script (it is small and readable). (2) Provide a dedicated Typefully API key with the least privilege needed and keep it in your environment or in pass (the script will try pass if no env var). (3) Be aware the script will call out over the network to Typefully and will error if pass is not installed and no env var is set. (4) Note the registry metadata omitted the required TYPEFULLY_API_KEY even though SKILL.md and the script require it — double-check you supply the key. If you need stronger isolation, run the script in a constrained environment or container and rotate the API key if you stop using the skill.Like a lobster shell, security has layers — review code before you run it.
latestvk975qqjtyq6343x6avme9cgtm181r78h
License
MIT-0
Free to use, modify, and redistribute. No attribution required.