dropspace
v1.0.3Create and publish social media launches via the Dropspace API. Use when user wants to post to social media, create launches, manage personas, track post ana...
⭐ 0· 85·1 current·1 all-time
by@jclvsh
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description map directly to the declared requirement (DROPSPACE_API_KEY) and the SKILL.md describes API calls to api.dropspace.dev for launches, personas, connections, analytics and publishing — all expected for a social-publishing skill.
Instruction Scope
SKILL.md contains concrete curl examples and API semantics limited to Dropspace endpoints and content generation guidance. It does not instruct reading unrelated system files, other env vars, or exfiltrating data to third-party endpoints.
Install Mechanism
No install spec and no code files — instruction-only. The docs mention an optional 'npx @jclvsh/dropspace-mcp' utility, but that is documented as optional and not required by the skill metadata; absence of an install reduces risk.
Credentials
Only requests a single env var (DROPSPACE_API_KEY), which is appropriate for an API-based publishing skill. The SKILL.md explicitly recommends least-privilege scopes and explains which scopes are needed for different workflows.
Persistence & Privilege
Skill is not set to always:true and does not request persistent system-level privileges or to modify other skills. Autonomous invocation is allowed (platform default) but publishing requires an API key with explicit 'publish' scope — controlled by the user.
Assessment
This skill appears coherent for posting via Dropspace. Before installing: 1) Only provide a Dropspace API key with the minimal scopes you need (avoid 'publish' or 'admin' unless required). 2) If you later use the optional npx package, remember npx runs code from the npm registry — only run it if you trust the package. 3) Monitor Dropspace audit logs and rotate/revoke the key if you stop using the skill. 4) If you plan to allow autonomous agent publishing, explicitly grant a separate key with only the publish scopes you intend and test it in a safe account first.Like a lobster shell, security has layers — review code before you run it.
latestvk976ch5nkjmnz7pdf2qtpsy69h83wbzt
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🚀 Clawdis
EnvDROPSPACE_API_KEY