Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Social Auto Poster
v1.1.0Automate posting content with images to LinkedIn, X/Twitter, Facebook, WordPress, and Substack via browser automation. Use when: (1) posting a new article or...
⭐ 0· 68·0 current·0 all-time
byQuốc MODORO@quoc-modoro
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (cross‑platform auto‑posting) matches the runtime instructions: browser automation for LinkedIn, X, Facebook, Substack plus REST calls for WordPress and local image generation. The required files/paths and WordPress application password are coherent with posting functionality.
Instruction Scope
SKILL.md instructs only actions relevant to publishing (start/stop browser, ARM upload, create images, POST via WP API) and includes platform‑specific DOM workarounds. Two minor scope/clarity issues: (1) it asks you to create a ~/.openclaw/.wp-[yoursite].env file but never explicitly tells the agent to source it before curl commands (implied but should be explicit); (2) it requires you to place/execute an external image script (~/workspace/linkedin-assets/create-overlay-image.sh) which is not included — you must inspect that script before running.
Install Mechanism
Instruction-only skill (no install spec, no downloaded binaries, no code files that execute). This is low install risk — nothing is written to disk by the skill package itself.
Credentials
The only credential material the skill requires is a WordPress Application Password stored in a plaintext file under ~/.openclaw/.wp-[yoursite].env and browser sessions kept logged in. That is proportionate to the stated purpose but has security implications (plaintext credential file, long‑lived browser sessions). The skill does not request unrelated secrets or system credentials.
Persistence & Privilege
always:false (normal). The skill depends on persistent browser sessions (recommends not killing Chrome) and on files under /tmp and the user's workspace. Persistent sessions increase theft risk if the host is shared; nothing in the skill tries to change agent/system settings or modify other skills.
Assessment
This skill appears internally consistent for automating posts, but before installing or using it you should: (1) verify the owner/source (no homepage provided) and prefer skills with a public repo/release; (2) inspect the image script (~/workspace/linkedin-assets/create-overlay-image.sh) — it will be executed and could run arbitrary shell commands; (3) prefer not to store credentials in world‑readable plaintext: restrict permissions on ~/.openclaw/.wp-[yoursite].env (chmod 600) or use a secrets store if available; (4) be aware the skill relies on long‑lived browser sessions — if the machine is multi‑user or exposed, an attacker with local access could reuse those sessions; (5) test on a throwaway account / VM first to confirm behavior; and (6) ask the publisher to: publish a source repo or homepage, add explicit steps to source the .env before API calls, and ideally support a safer credential mechanism. If you cannot inspect the image script and do not trust keeping browser sessions persistent, do not enable this skill.Like a lobster shell, security has layers — review code before you run it.
automationvk979g406b15jt6xp0art6mzw1983rwk7facebookvk979g406b15jt6xp0art6mzw1983rwk7latestvk979g406b15jt6xp0art6mzw1983rwk7linkedinvk979g406b15jt6xp0art6mzw1983rwk7socialvk979g406b15jt6xp0art6mzw1983rwk7substackvk979g406b15jt6xp0art6mzw1983rwk7twittervk979g406b15jt6xp0art6mzw1983rwk7wordpressvk979g406b15jt6xp0art6mzw1983rwk7
License
MIT-0
Free to use, modify, and redistribute. No attribution required.