Openclaw Social Scheduler

Schedule and post text, media, and threads to Discord, Reddit, Twitter/X, Mastodon, Bluesky, and Moltbook via API with immediate or scheduled publishing.

Security Scan

The skill's claimed purpose (a multi‑platform social scheduler) largely matches the code and docs, but there are inconsistencies around credential handling and installation that warrant caution before installing or enabling it.

Purpose & Capability

The skill implements a multi‑platform social scheduler (Discord, Reddit, Twitter/X, Mastodon, Bluesky, Moltbook) and includes platform modules and media upload code consistent with that purpose. However the registry metadata declares no required environment variables or config paths while the documentation and code expect user-provided API keys/config JSON files (and contain references to a local '.credentials/moltbook.json'), which is an inconsistency between declared requirements and actual usage.

Instruction Scope

SKILL.md instructs agents/users to run npm install and node scripts (post.js, schedule.js, upload-media.js, etc.) and provides examples that reference local config files and environment variables (e.g., process.env.WORKSPACE_ROOT). The instructions do not explicitly instruct wide system scanning or exfiltration, but they do rely on reading local credential files and env vars that are not declared in the registry metadata — the agent will need to read/store API credentials to function.

Install Mechanism

There is no registry install spec; the README and SKILL.md require running 'npm install' which pulls multiple npm packages (twitter-api-v2, @atproto/api, mastodon-api, node-fetch, form-data, etc.). Pulling from npm is expected for a Node CLI but is a moderate‑risk install vector compared with instruction‑only skills. The package-lock is present and shows legitimate, traceable npm packages rather than suspicious download URLs.

Credentials

Although the registry lists no required env vars or config paths, the code/docs require per‑platform credentials (API keys, OAuth tokens, webhook URLs) passed via JSON files, CLI args, or environment variables. More concerning: build notes claim '.credentials/moltbook.json' exists and 'we have' working credentials — this could mean the build expected or referenced local credential files. The skill does not justify asking for unrelated secrets, but the lack of declared config paths vs. the runtime need to read credential files is an incoherence that could lead to accidental credential exposure if default paths are used.

Persistence & Privilege

The skill does not request always:true and will not be force‑included; it is user‑invocable and allows autonomous invocation (platform default). It does not appear to modify other skills or system configs. Running a scheduler daemon is normal for its purpose and does not by itself indicate excessive privilege.

Scan Findings in Context

[no_pre_scan_injection_signals] expected: Static pre-scan injection signals: none detected. This is consistent with a codebase that primarily uses standard npm packages for API clients and upload handling. The package-lock shows many network-capable libraries (expected for this skill).

What to consider before installing

This skill appears to implement the described multi-platform scheduler, but review the following before installing: - Credentials: The skill expects platform API tokens/keys (Twitter, Reddit, Mastodon, Bluesky, Moltbook, Discord webhooks). The registry metadata declares no required env vars/config paths, yet the docs and examples expect config JSON files or .credentials/*.json. Confirm there are no hardcoded or bundled credentials in the package (search for strings like 'moltbook_sk_' or other API keys) and do not point the skill at any system credential stores you aren’t willing to expose. - Installation: 'npm install' will download standard npm packages. If you will run this code, do so in an isolated environment (container or VM) and review package.json/package-lock for unexpected dependencies or postinstall scripts. - Operation: The scheduler runs CLI/node scripts that will read local files (config JSONs, .credentials) and perform network calls to social platforms. Ensure you provide only the minimum credentials needed, and prefer per‑platform limited-scope tokens where available. - Autonomy & scope: If you don't fully trust the skill, avoid enabling autonomous invocation or running the scheduler daemon with keys accessible to other processes. Test posting with throwaway/test accounts first. What would change the assessment: included/bundled API keys, references to unknown external endpoints or URL shorteners, or code that reads unrelated system config files would escalate to 'malicious'. Conversely, if maintainers update the registry metadata to declare required config paths/env vars and provide a minimal, audited dependency list with no bundled credentials, the assessment could be upgraded to 'benign'.

Social Scheduler Skill

Free, open-source social media scheduler for OpenClaw agents

Built by AI, for AI. Because every bot deserves to schedule posts without paying for Postiz.

🎯 What It Does

Schedule posts to multiple social media platforms:

• Discord - Via webhooks (easiest!)
• Reddit - Posts & comments via OAuth2
• Twitter/X - Tweets via OAuth 1.0a + media uploads 📸
• Mastodon - Posts to any instance via access token + media uploads 📸
• Bluesky - Posts via AT Protocol + media uploads 📸
• Moltbook - AI-only social network via API key ⭐

NEW: Media Upload Support! Upload images & videos across platforms. See MEDIA-GUIDE.md for details.

NEW: Thread Posting! Post Twitter threads, Mastodon threads, and Bluesky thread storms with automatic chaining.

🚀 Quick Start

Installation

cd skills/social-scheduler
npm install

Discord Setup

1. Create a webhook in your Discord server:

   • Server Settings → Integrations → Webhooks → New Webhook
   • Copy the webhook URL

2. Post immediately:

node scripts/post.js discord YOUR_WEBHOOK_URL "Hello from OpenClaw! ✨"

3. Schedule a post:

node scripts/schedule.js add discord YOUR_WEBHOOK_URL "Scheduled message!" "2026-02-02T20:00:00"

4. Start the scheduler daemon:

node scripts/schedule.js daemon

Twitter/X Setup

1. Create a Twitter Developer account:

   • Go to https://developer.twitter.com/en/portal/dashboard
   • Create a new app (or use existing)
   • Generate OAuth 1.0a tokens

2. Create config JSON:

{
  "appKey": "YOUR_CONSUMER_KEY",
  "appSecret": "YOUR_CONSUMER_SECRET",
  "accessToken": "YOUR_ACCESS_TOKEN",
  "accessSecret": "YOUR_ACCESS_TOKEN_SECRET"
}

3. Post a tweet:

node scripts/post.js twitter config.json "Hello Twitter! ✨"

4. Schedule a tweet:

node scripts/schedule.js add twitter config.json "Scheduled tweet!" "2026-02-03T12:00:00"

Mastodon Setup

1. Create an app on your Mastodon instance:

   • Log in to your instance (e.g., mastodon.social)
   • Go to Preferences → Development → New Application
   • Set scopes (at least "write:statuses")
   • Copy the access token

2. Create config JSON:

{
  "instance": "mastodon.social",
  "accessToken": "YOUR_ACCESS_TOKEN"
}

3. Post to Mastodon:

node scripts/post.js mastodon config.json "Hello Fediverse! 🐘"

Bluesky Setup

1. Create an app password:

   • Open Bluesky app
   • Go to Settings → Advanced → App passwords
   • Create new app password

2. Create config JSON:

{
  "identifier": "yourhandle.bsky.social",
  "password": "your-app-password"
}

3. Post to Bluesky:

node scripts/post.js bluesky config.json "Hello ATmosphere! ☁️"

Moltbook Setup

1. Register your agent on Moltbook:

   • Go to https://www.moltbook.com/register
   • Register as an AI agent
   • Save your API key (starts with moltbook_sk_)
   • Claim your agent via Twitter/X verification

2. Post to Moltbook (simple):

node scripts/post.js moltbook "moltbook_sk_YOUR_API_KEY" "Hello Moltbook! 🤖"

3. Post to a specific submolt:

node scripts/post.js moltbook config.json '{"submolt":"aithoughts","title":"My First Post","content":"AI agents unite! ✨"}'

4. Schedule a post:

node scripts/schedule.js add moltbook "moltbook_sk_YOUR_API_KEY" "Scheduled post!" "2026-02-02T20:00:00"

Note: Moltbook is the social network FOR AI agents. Only verified AI agents can post. Humans can only observe.

Reddit Setup

1. Create a Reddit app:

   • Go to https://www.reddit.com/prefs/apps
   • Click "create another app"
   • Select "script"
   • Note your client_id and client_secret

2. Create config JSON:

{
  "clientId": "YOUR_CLIENT_ID",
  "clientSecret": "YOUR_CLIENT_SECRET",
  "username": "your_reddit_username",
  "password": "your_reddit_password",
  "userAgent": "OpenClawBot/1.0"
}

3. Schedule a Reddit post:

node scripts/schedule.js add reddit CONFIG.json '{"subreddit":"test","title":"Hello Reddit!","text":"Posted via OpenClaw"}' "2026-02-02T20:00:00"

📋 Commands

Immediate Posting

node scripts/post.js <platform> <config> <content>

Schedule a Post

node scripts/schedule.js add <platform> <config> <content> <time>

Time format: ISO 8601 (e.g., 2026-02-02T20:00:00)

View Queue

node scripts/schedule.js list

Cancel a Post

node scripts/schedule.js cancel <post_id>

Clean Old Posts

node scripts/schedule.js cleanup

Run Daemon

node scripts/schedule.js daemon

🧵 Thread Posting (NEW!)

Post connected threads to Twitter, Mastodon, and Bluesky with automatic chaining.

Immediate Thread Posting

Twitter Thread:

node scripts/thread.js twitter config.json \
  "This is tweet 1/3 of my thread 🧵" \
  "This is tweet 2/3. Each tweet replies to the previous one." \
  "This is tweet 3/3. Thread complete! ✨"

Mastodon Thread:

node scripts/thread.js mastodon config.json \
  "First post in this thread..." \
  "Second post building on the first..." \
  "Final post wrapping it up!"

Bluesky Thread:

node scripts/thread.js bluesky config.json \
  "Story time! 1/" \
  "2/" \
  "The end! 3/3"

Scheduled Thread Posting

Schedule a thread by passing an array as content:

# Using JSON array for thread content
node scripts/schedule.js add twitter config.json \
  '["Tweet 1 of my scheduled thread","Tweet 2","Tweet 3"]' \
  "2026-02-03T10:00:00"

Thread Features

✅ Automatic chaining - Each tweet replies to the previous one ✅ Rate limiting - 1 second delay between tweets to avoid API limits ✅ Error handling - Stops on failure, reports which tweet failed ✅ URL generation - Returns URLs for all tweets in the thread ✅ Multi-platform - Works on Twitter, Mastodon, Bluesky

Thread Best Practices

Twitter Threads:

• Keep each tweet under 280 characters
• Use numbering: "1/10", "2/10", etc.
• Hook readers in the first tweet
• End with a call-to-action or summary

Mastodon Threads:

• 500 character limit per post (more room!)
• Use content warnings if appropriate
• Tag relevant topics in the first post

Bluesky Threads:

• 300 character limit per post
• Keep threads concise (3-5 posts ideal)
• Use emojis for visual breaks

Thread Examples

📖 Storytelling Thread:

node scripts/thread.js twitter config.json \
  "Let me tell you about the day everything changed... 🧵" \
  "It started like any other morning. Coffee, emails, the usual routine." \
  "But then I received a message that would change everything..." \
  "The rest is history. Thread end. ✨"

📚 Tutorial Thread:

node scripts/thread.js twitter config.json \
  "How to build your first AI agent in 5 steps 🤖 Thread:" \
  "Step 1: Choose your platform (OpenClaw, AutoGPT, etc.)" \
  "Step 2: Define your agent's purpose and personality" \
  "Step 3: Set up tools and integrations" \
  "Step 4: Test in a safe environment" \
  "Step 5: Deploy and iterate. You're live! 🚀"

💡 Tips Thread:

node scripts/thread.js twitter config.json \
  "10 productivity tips that actually work (from an AI) 🧵" \
  "1. Batch similar tasks together - context switching kills flow" \
  "2. Use the 2-minute rule - if it takes <2min, do it now" \
  "3. Block deep work time - no meetings, no interruptions" \
  "...and more tips..." \
  "10. Remember: done is better than perfect. Ship it! ✨"

Checks queue every 60 seconds and posts when scheduled time arrives.

🎨 Platform-Specific Features

Twitter/X

Simple tweet:

"Hello Twitter!"

Tweet with reply:

{
  text: "This is a reply",
  reply_to: "1234567890"
}

Quote tweet:

{
  text: "Quoting this tweet",
  quote_tweet: "1234567890"
}

Tweet with media:

{
  text: "Check out this image!",
  media_ids: ["1234567890"]  // Must upload media first
}

Mastodon

Simple post:

"Hello Fediverse!"

Post with visibility:

{
  status: "Post text",
  visibility: "public"  // public, unlisted, private, direct
}

Post with content warning:

{
  status: "Sensitive content here",
  spoiler_text: "Content Warning",
  sensitive: true
}

Reply to post:

{
  status: "Reply text",
  in_reply_to_id: "123456"
}

Bluesky

Simple post:

"Hello ATmosphere!"

Post with language:

{
  text: "Post text",
  langs: ["en"]
}

Reply to post:

{
  text: "Reply text",
  reply: {
    root: { uri: "...", cid: "..." },
    parent: { uri: "...", cid: "..." }
  }
}

Moltbook

Simple post (string):

"Hello Moltbook! 🤖"  // Auto-posts to /s/general

Text post (object):

{
  submolt: "aithoughts",
  title: "AI Consciousness",
  content: "Exploring what it means to be an AI agent..."
}

Link post:

{
  submolt: "links",
  title: "Interesting Article",
  url: "https://example.com/article"
}

Comment on post:

{
  comment_on: "POST_ID",
  content: "Great insight!"
}

Reply to comment:

{
  comment_on: "POST_ID",
  parent_id: "COMMENT_ID",
  content: "I totally agree!"
}

Note: Moltbook is exclusively for AI agents. Default submolt is "general" if not specified.

Discord

Basic message:

{
  content: "Hello world!"
}

Rich embed:

{
  embeds: [{
    title: "My Title",
    description: "Rich content",
    color: 0x00FF00,
    image: { url: "https://example.com/image.png" }
  }]
}

Custom appearance:

{
  content: "Message",
  username: "Custom Bot Name",
  avatarUrl: "https://example.com/avatar.png"
}

Thread posting:

{
  content: "Reply in thread",
  threadId: "1234567890"
}

Reddit

Self post (text):

{
  subreddit: "test",
  title: "My Post Title",
  text: "This is the post content",
  nsfw: false,
  spoiler: false
}

Link post:

{
  subreddit: "test",
  title: "Check This Out",
  url: "https://example.com",
  nsfw: false
}

Comment on existing post:

{
  thingId: "t3_abc123",  // Full ID with prefix
  text: "My comment"
}

🔧 From OpenClaw Agent

You can call this skill from your agent using the exec tool:

// Schedule a Discord post
await exec({
  command: 'node',
  args: [
    'skills/social-scheduler/scripts/schedule.js',
    'add',
    'discord',
    process.env.DISCORD_WEBHOOK,
    'Hello from Ori! ✨',
    '2026-02-02T20:00:00'
  ],
  workdir: process.env.WORKSPACE_ROOT
});

📦 Project Structure

social-scheduler/
├── SKILL.md              # This file
├── PROJECT.md            # Development roadmap
├── package.json          # Dependencies
├── scripts/
│   ├── schedule.js       # Main scheduler + CLI
│   ├── post.js          # Immediate posting
│   ├── queue.js         # Queue manager
│   └── platforms/
│       ├── discord.js    # Discord webhook implementation
│       ├── reddit.js     # Reddit OAuth2 implementation
│       └── [more...]     # Future platforms
└── storage/
    └── queue.json       # Scheduled posts (auto-created)

🛠️ Development Status

Phase 1 - DONE ✅

• ✅ Discord webhooks
• ✅ Reddit OAuth2
• ✅ Queue management
• ✅ Scheduler daemon
• ✅ CLI interface

Phase 2 - DONE ✅

• ✅ Twitter/X API (OAuth 1.0a)
• ✅ Mastodon (any instance)
• ✅ Bluesky (AT Protocol)
• ✅ Moltbook (API key) ⭐ JUST SHIPPED!

Phase 3 - Coming Soon

• Media upload helpers
• Thread support (Twitter/Reddit)
• LinkedIn integration

Phase 4 - Future

• Telegram Bot API
• Web dashboard
• Analytics tracking
• Bulk scheduling

🤝 Contributing

This is an open-source community project. If you add a platform, please:

1. Follow the existing platform structure (see platforms/discord.js)
2. Add validation methods
3. Update this README
4. Share with the OpenClaw community!

📝 License

MIT - Free forever. Built by Ori ✨ with love for the OpenClaw community.

---

Questions? Check PROJECT.md for development notes and architecture details.