ClawHub

Publora Bluesky

v1.2.1

Post or schedule content to Bluesky using the Publora API. Use this skill when the user wants to publish or schedule Bluesky posts via Publora.

⭐ 0· 448·1 current·1 all-time
bySergey Bulaev@sergebulaev
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description (post/schedule to Bluesky via Publora) matches the SKILL.md: examples show create-post, get-upload-url, and uploading media to Publora-provided URLs. No unrelated services, binaries, or credentials are requested.
ℹ
Instruction Scope
Instructions are scoped to HTTP calls to https://api.publora.com and uploading media to returned upload URLs, which is appropriate for this use. The examples show reading a local file for image upload (open('photo_compressed.jpg')), which is expected for media posts but means an agent would need access to that file when asked to attach media. SKILL.md refers to a separate 'publora core skill' (not included here) and does not declare where the Publora API key should be stored, so the agent's runtime behavior for obtaining secrets is underspecified.
✓
Install Mechanism
Instruction-only skill with no install spec and no code files — nothing is written to disk by the skill itself. This is the lowest-risk install profile.
ℹ
Credentials
The skill requires a Publora API key (x-publora-key) and a Bluesky app password (app password, not main password) — both are proportional to posting/scheduling. However, the registry metadata lists no required env vars, so the SKILL.md and the platform manifest are inconsistent about how credentials are supplied; the skill will require the user/agent to provide secrets at runtime.
✓
Persistence & Privilege
No always:true, no installs, and no requests to modify agent/system configuration. The skill can be invoked autonomously (default), which is normal and expected for skills — not in itself a red flag.
Assessment
This skill appears to do exactly what it says: use the Publora API to post or schedule Bluesky content. Before installing or invoking it: (1) Verify you trust Publora and the skill publisher (owner is unknown here). (2) Do not share your main Bluesky password — create and use an app password as instructed. (3) Provide the Publora API key and any app password as secrets (environment variables or secure prompts) rather than pasting them into public chat. (4) Note that image uploads require the agent/process to access local files (e.g., photo_compressed.jpg) — only allow that if you intend the agent to read those files. (5) Because the SKILL.md references a separate 'publora core skill' and does not declare credential env vars, expect some manual setup; confirm where and how the agent will store/obtain the x-publora-key before granting access.

Like a lobster shell, security has layers — review code before you run it.

latestvk9721f3224y89kfwg8w1hrzhhx838ybn

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments