Security checks across malware telemetry and agentic risk
This skill is for social media scheduling, but it ships a fixed Postiz account password and can publish, upload, list, update, and delete posts through that account.
Review before installing. Only use this if you intentionally control the referenced Postiz instance and social channels. The exposed password should be rotated, hardcoded credentials removed, the server and integrations made user-configurable, and session cookies stored securely or avoided.
```bash
# Login and save cookie (required before any API call)
curl -s -c /tmp/postiz-cookies.txt \
'https://postiz.home.mykuhlmann.com/api/auth/login' \
-H 'Content-Type: application/json' \
-d '{"email":"sascha@mykuhlmann.com","password":"Postiz2026!","provider":"LOCAL"}'### Upload Image
```bash
# Upload returns {id, path}
curl -s -b /tmp/postiz-cookies.txt \
'https://postiz.home.mykuhlmann.com/api/media/upload-simple' \
-F 'file=@/path/to/image.png'
```66/66 vendors flagged this skill as clean.