Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Social Publisher
v1.0.0Automate social media publishing, engagement, and analytics. Schedule posts across 10+ platforms (Twitter/X, LinkedIn, Instagram, Facebook, TikTok, YouTube,...
⭐ 0· 177·0 current·0 all-time
byFuhaolin@fuczy
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill's described capabilities (multi-platform posting, scheduling, engagement, analytics) match the instructions in SKILL.md. However, the registry metadata lists required binaries as [openclaw, curl] while all runtime examples use the 'clawhub' CLI. That binary-name mismatch is an incoherence (either the declared requirements are wrong or the docs/examples target a different CLI).
Instruction Scope
SKILL.md instructs the agent/user to create a social-config.yaml that will contain many platform API keys and secrets and to run commands (clawhub workflow start/preview/calendar). It also references integrations that require other credentials (DALL-E/Midjourney, email, Slack, custom APIs). The instructions do not direct the agent to read unrelated system files, but they do rely on user-provided credential files and external services that are not declared in the skill metadata. That gap is a notable scope mismatch.
Install Mechanism
This is an instruction-only skill with no install spec or code files, so nothing will be written to disk by an installer. That lowers installation risk.
Credentials
The skill requests no environment variables at the registry level, yet SKILL.md expects many sensitive API keys/secrets to be supplied in social-config.yaml (Twitter/X, LinkedIn, Instagram, YouTube, DALL-E/Midjourney, email/slack distribution credentials, etc.). Not declaring any primary credential is plausible for an instruction-only skill, but the absence of declared required secrets while the instructions require broad platform credentials is inconsistent and increases the chance of accidental credential exposure or misconfiguration.
Persistence & Privilege
always:false (good) and model invocation is allowed (normal). Because the skill enables autonomous actions with direct effect on external accounts (auto-replies, follows, posts), consider the operational risk of enabling autonomous invocation even though this alone is not a registry policy violation.
What to consider before installing
This skill appears to do what it says, but there are inconsistencies you should resolve before installing: 1) Verify which CLI the skill actually expects — SKILL.md uses 'clawhub' while metadata requires 'openclaw'. 2) Understand where and how you will store API keys: the skill expects a YAML file with many secrets but doesn't declare them in the metadata. 3) Confirm which external services (DALL‑E/Midjourney, email, Slack, custom APIs) will be contacted and supply only the credentials you trust. 4) If you plan to allow autonomous invocation, restrict or review its permissions (auto-replies/follows) to avoid unwanted actions. If you cannot reconcile the binary mismatch or the list of external integrations, treat this skill as untrusted until clarified.Like a lobster shell, security has layers — review code before you run it.
latestvk9751fqtatn32mnfmvhvrkeg8x832k6g
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
📱 Clawdis
Binsopenclaw, curl