Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

POST AI Automation

v1.0.0

Automate TikTok and Instagram video creation and scheduled posting from one product image using POST AI with customizable styles, captions, and performance t...

0· 348·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for nyamiresepdapur-droid/postai-automation.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "POST AI Automation" (nyamiresepdapur-droid/postai-automation) from ClawHub.
Skill page: https://clawhub.ai/nyamiresepdapur-droid/postai-automation
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Canonical install target

openclaw skills install nyamiresepdapur-droid/postai-automation

ClawHub CLI

Package manager switcher

npx clawhub@latest install postai-automation
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The skill claims to automate POST AI video generation and posting — the scripts implement that workflow and require a POST AI API key plus TikTok/Instagram cookies/session_id. However, the registry metadata declared no required environment variables or credentials while package.json lists Python requirements; the metadata therefore under-represents needed secrets and runtime requirements. This mismatch is unexpected and reduces transparency.
!
Instruction Scope
SKILL.md instructs storing API keys and browser cookies/session_id in config.json and running scripts (generate, auto_upload, batch_process). The scripts read config.json directly and will download images from arbitrary URLs and may run browser automation (TODO notes). The SKILL.md references additional scripts (previews.py, daily_post.py, track_performance.py) that are not present in the package — this is incoherent. Storing session cookies and session_id in a config file is sensitive and the instructions do not recommend safer alternatives (e.g., env vars, OS keyring).
Install Mechanism
There is no install spec (instruction-only plus Python scripts). No remote downloads or installers are executed by the skill itself. That limits supply-chain risk compared to arbitrary URL downloads, but the package assumes a Python runtime and will invoke subprocesses and network calls.
!
Credentials
The skill requires POST AI API credentials and TikTok/Instagram cookie files/session_id (sensitive tokens) stored in config.json; these are proportionate to an uploader but the registry metadata did not declare them. The config.example.json itself contains mistakes (malformed JSON) and reveals that sensitive data will be stored in plaintext files by default — a potential secret-exposure risk. No primary credential is declared in metadata.
Persistence & Privilege
always:false and default model-invocation are used (normal). The skill writes temp files, outputs, and a batch_summary.jsonl in its skill directory and suggests adding a cron job; it does not request elevated system privileges or alter other skills. Still, because it can be scheduled to run unattended and uses account cookies/API keys, autonomous operation increases blast radius if credentials are mishandled.
What to consider before installing
This skill appears to implement the advertised video-generation and upload workflow, but several issues need attention before you run it: - Expect to provide sensitive credentials: POST AI API key and TikTok/Instagram cookie files/session_id. The code reads them from config.json (plaintext). Prefer storing secrets in environment variables or a secure keyring rather than a repo file. - Registry metadata did NOT declare these credentials or Python requirements — that's an inconsistency. Treat the package as requiring Python 3.8+ and manual credential configuration. - SKILL.md references scripts that are missing (previews.py, daily_post.py, track_performance.py). The package has placeholders (TODO) for actual TikTok/Instagram upload logic. The upload functions currently simulate behavior; real browser automation or API calls would need additional dependencies and credentials. - config.example.json contains a JSON syntax error (malformed posting_schedule entry). Fix the example before copying to config.json. - Review how cookies/session_id are obtained and stored. Exporting full browser cookies can expose other accounts; only extract the minimum tokens needed and store them securely. - Audit the code paths that download images (arbitrary URLs) and run subprocesses — run in an isolated environment (container or VM) and avoid running with elevated privileges. - Verify the legitimacy of POST AI (postai.myscalev.com / api.postai.com) and costs before entering payment/keys. If you decide to use it: run it in a sandbox, fix the config example, move secrets out of repo files, and manually inspect/complete the upload implementation (or replace with a vetted library) before scheduling automatic runs.

Like a lobster shell, security has layers — review code before you run it.

latestvk97675xq4xvfzgvrfbb7jpzvm18298sj
348downloads
0stars
1versions
Updated 4h ago
v1.0.0
MIT-0

POST AI Automation

Automate TikTok/Instagram video creation and posting using POST AI platform.

What is POST AI?

POST AI is an AI-powered tool that turns 1 product image into dozens of TikTok FYP videos with auto-caption and voice-over.

Use Cases

  • Affiliate Marketing: Generate 10-20 videos per product automatically
  • E-commerce: Create product showcases at scale
  • Content Automation: Daily posting without manual effort
  • A/B Testing: Test multiple video variants to see what works

Setup

  1. Purchase POST AI: https://postai.myscalev.com/
  2. Extract credentials from email/confirmation
  3. Copy config.example.json to config.json
  4. Fill in your credentials:
{
  "postai": {
    "api_key": "your_api_key",
    "account_id": "your_account_id",
    "endpoint": "https://api.postai.com/v1"
  },
  "tiktok": {
    "account": "@youraccount",
    "cookie_file": "/path/to/cookies.json",
    "session_id": "your_session_id"
  },
  "instagram": {
    "account": "@youraccount",
    "cookie_file": "/path/to/cookies.json"
  }
}

Commands

Generate Videos

Generate multiple video variants from a single product image:

python scripts/generate_videos.py \
  --image products/shirt.jpg \
  --count 10 \
  --platform tiktok \
  --style hype \
  --language id \
  --output videos/shirt/

Options:

  • --image: Path to product image
  • --count: Number of videos to generate (default: 5)
  • --platform: Target platform (tiktok, instagram, threads)
  • --style: Video style (hype, calm, energetic, professional)
  • --language: Language for voice-over (id, en)
  • --output: Output directory

Auto Upload

Upload generated videos with automatic scheduling:

python scripts/auto_upload.py \
  --source videos/shirt/*.mp4 \
  --platform tiktok \
  --caption-file captions/shirt.txt \
  --schedule "2026-03-05 08:00,14:00,20:00"

Options:

  • --source: Glob pattern for video files
  • --platform: Target platform
  • --caption-file: Text file with captions (one per line)
  • --schedule: Comma-separated schedule (YYYY-MM-DD HH:MM)
  • --hashtags: Custom hashtags (comma-separated)

Batch Process

Process multiple products from CSV:

python scripts/batch_process.py \
  --input products.csv \
  --platforms tiktok,instagram \
  --videos-per-product 10 \
  --schedule "08:00,14:00,20:00"

CSV Format (products.csv):

product_name,image_url,price,affiliate_link,caption_template
T-Shirt Merah,https://example.com/shirt.jpg,150000,https://aff.link/shirt,Promo {price}!
Kemeja Hijau,https://example.com/shirt2.jpg,200000,https://aff.link/shirt2,Fashion terbaru!

Workflow Examples

Quick Start (Single Product)

# 1. Generate videos
python scripts/generate_videos.py --image produk.jpg --count 10 --platform tiktok

# 2. Preview before upload
python scripts/previews.py --source videos/produk/

# 3. Upload manually or scheduled
python scripts/auto_upload.py --source videos/produk/*.mp4 --platform tiktok

Daily Automation (Cron)

Add to crontab for daily 3x posting:

# Post at 8 AM, 2 PM, 8 PM every day
0 8,14,20 * * * cd ~/.openclaw/workspace/skills/postai-automation && python scripts/daily_post.py

A/B Testing

Generate multiple styles for the same product:

python scripts/generate_videos.py \
  --image produk.jpg \
  --styles hype,calm,professional \
  --count 5 \
  --platform tiktok

Then upload all variants and track performance to find best-performing style.

Performance Tracking

Track which videos generate the most engagement/sales:

python scripts/track_performance.py \
  --days 7 \
  --metrics views,likes,comments,sales

Output:

Video            Views   Likes  Comments  Sales  Conversion Rate
produk_v1.mp4    15.2K   2.3K   156       23     0.15%
produk_v2.mp4    8.5K    1.2K   89        12     0.14%
produk_v3.mp4    22.1K   4.5K   234       67     0.30% ⭐ Best

Caption Templates

Use placeholders in caption templates:

  • {product_name}: Product name
  • {price}: Price (formatted: Rp 150.000)
  • {affiliate_link}: Your affiliate link
  • {hashtag}: Auto-generated hashtags
  • {emoji}: Relevant emojis based on product

Example template:

🔥 {product_name} - {price}

Jangan sampai kehabisan! Order sekarang:
{affiliate_link}

{hashtag}

#fyp #affiliatemarketing #promotion

Troubleshooting

Videos not uploading to TikTok:

  • Check if cookies are expired: Re-export cookies from browser
  • Verify session_id is correct
  • Check TikTok account status (not banned/limited)

POST AI API errors:

  • Verify API key is valid
  • Check your subscription status
  • Ensure account has remaining credits

Caption generation issues:

  • Check language settings
  • Ensure caption template is valid
  • Verify hashtags are not blacklisted

Best Practices

  1. A/B Test Everything: Generate multiple variants to find what works
  2. Schedule Strategically: Test different posting times (8, 14, 20 are good starts)
  3. Mix Styles: Don't use same style every time - variety keeps audience engaged
  4. Track Performance: Use tracking script to identify winning patterns
  5. Quality Over Quantity: 5 great videos > 20 mediocre videos

Limitations

  • POST AI relies on external API service - check their status if issues occur
  • TikTok has rate limits - don't spam upload
  • Instagram has stricter anti-bot measures than TikTok
  • Voice-over quality depends on POST AI's TTS engine

Integration with Other Skills

  • content-generator: Generate script ideas for videos
  • social-media-upload: Cross-platform posting
  • analytics-dashboard: Track performance across campaigns
  • humanizer: Make AI-generated captions more natural

Support

For POST AI platform issues: Contact their support via https://postai.myscalev.com/

For skill issues: Open issue at BerkahKarya or contact Veris directly.

Comments

Loading comments...