Publora Threads

ReviewAudited by ClawScan on May 10, 2026.

Overview

This instruction-only skill is a straightforward Publora/Threads posting guide, but it can publish or schedule content using a Publora API key.

Install/use this only if you intend the agent to help publish or schedule Threads posts through Publora. Before sending, verify the final post text, media, platform ID, and schedule time, and protect the Publora API key like an account credential.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If used with a valid API key, the agent can create or schedule posts on the linked Threads account.

Why it was flagged

This documents a direct API call that creates a Threads post. That is purpose-aligned, but it is a high-impact action because it can publish content from the user's connected account.

Skill content
await fetch('https://api.publora.com/api/v1/create-post', { method: 'POST', ... body: JSON.stringify({ content: '...', platforms: ['threads-17841412345678'] }) });
Recommendation

Confirm the exact content, target account/platform ID, media, and scheduled time before allowing the request to be sent.

What this means

Anyone with the API key may be able to act through the associated Publora workspace/account, depending on the key's permissions.

Why it was flagged

The skill requires a Publora API key and account-specific platform ID to act on the user's connected Threads account. This is expected for the service, but it is sensitive account authority.

Skill content
**Header:** `x-publora-key: sk_YOUR_KEY`  
**Platform ID format:** `threads-{accountId}`
Recommendation

Use a properly scoped key if Publora supports it, keep it out of chat logs where possible, and revoke or rotate it if it is exposed.

What this means

Images or videos selected for posting will be uploaded to Publora's storage path before publication.

Why it was flagged

The media-upload flow sends image bytes to a signed upload URL returned by Publora. This is expected for media posting, but users should understand that selected media leaves the local environment.

Skill content
// Step 3: Upload to S3
await fetch(upload.uploadUrl, { method: 'PUT', headers: { 'Content-Type': 'image/jpeg' }, body: imageBytes });
Recommendation

Only upload media intended for the Threads post, and avoid including private or unintended files.