Publora Bluesky
PassAudited by ClawScan on May 10, 2026.
Overview
This is a coherent instruction-only Bluesky publishing skill, but it uses a Publora API key and can create or schedule public posts, so users should confirm content and account details before use.
This skill is reasonable for publishing to Bluesky via Publora. Install or use it only if you are comfortable giving the agent access to a Publora API key tied to your Bluesky account, and always verify the final text, media, destination account, and schedule before allowing a post.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If used with real credentials and platform IDs, the agent could publish or schedule visible Bluesky posts through Publora.
The skill documents API calls that create or schedule Bluesky posts, which is exactly its purpose but can publicly publish content on the user's behalf.
await fetch('https://api.publora.com/api/v1/create-post', { method: 'POST', ... body: JSON.stringify({ content: ..., platforms: ['bluesky-did:plc:abc123'] }) });Before use, confirm the exact post text, media, target Bluesky DID/platform ID, and scheduled time; avoid letting the agent post ambiguous or unapproved content.
Anyone or any agent with the Publora key may be able to act through the connected Publora workspace and post to the linked Bluesky account.
The workflow depends on a Publora API key and a connected Bluesky account using an app password; this delegated authority is expected, but it is sensitive account access.
**Header:** `x-publora-key: sk_YOUR_KEY` ... A Bluesky account connected via **username + app password**
Use a dedicated Bluesky app password, keep the Publora API key out of prompts and shared logs, rotate it if exposed, and grant only the workspace/account access needed.
Selected media files used in posts will be sent to Publora and then used for Bluesky publishing.
The skill shows uploading a selected local image file to a Publora-provided upload URL; this is purpose-aligned for posting media but transfers local content to an external service.
with open('photo_compressed.jpg', 'rb') as f:
requests.put(upload['uploadUrl'], headers={'Content-Type': 'image/jpeg'}, data=f)Only upload files intended for public posting, and verify that images do not contain private metadata or sensitive visual content.