Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Publora Twitter
v2.0.1Post or schedule content to X (Twitter) using the Publora API. Use this skill when the user wants to tweet, schedule a tweet, or post a thread to X/Twitter v...
⭐ 0· 736·1 current·1 all-time
bySergey Bulaev@sergebulaev
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The SKILL.md shows coherent, purpose-aligned behavior (calling publora endpoints to create posts, schedule, upload media). However, it requires an 'x-publora-key' API key in examples while the registry metadata declares no required environment variables or primary credential. The skill also references a separate 'publora' core skill for auth — the relationship/dependency is not expressed in the metadata, which is an incoherence.
Instruction Scope
The runtime instructions stay on-topic: examples show HTTP calls to publora endpoints, threading/scheduling/media rules, and no instructions to read local files, shell history, or unrelated system state. The main scope issue is that the instructions assume the agent has access to a Publora API key but do not show how that key should be supplied or protected.
Install Mechanism
This is an instruction-only skill with no install spec and no code files, so there is no installer or downloaded code to evaluate — low installation risk. The scanner had nothing to analyze.
Credentials
SKILL.md uses an API key header ('x-publora-key: sk_YOUR_KEY') but the skill metadata lists no required env vars or primary credential. That omission is a proportionality/information problem: the skill clearly needs a secret to operate, but the registry does not declare where that secret should come from or what environment variable name should be used, making it unclear how secrets will be handled and increasing the risk of ad-hoc secret provisioning or accidental exposure.
Persistence & Privilege
The skill does not request always:true and is user-invocable only; it does not claim to modify other skills or system-wide settings. No elevated persistence or privilege is requested in the metadata.
What to consider before installing
This skill appears to do what it says (post/schedule threads via the Publora API), but the package metadata fails to declare the required Publora API key. Before installing or using it, ask the publisher to clarify how the API key is supplied (which env var or secret store), confirm the existence and provenance of the referenced 'publora' core skill, and verify the skill's source/homepage (none is provided). Only provide an API key you control and rotate it if you suspect misuse. If you need stronger assurance, prefer a skill that explicitly declares its required credential (primaryEnv) and links to a verifiable source or homepage.Like a lobster shell, security has layers — review code before you run it.
latestvk976b6ne8gtdeh0g2ksz9vryzd839frt
License
MIT-0
Free to use, modify, and redistribute. No attribution required.