Social Media Suite

Automate social media posting to Instagram and YouTube. Schedule and publish images, videos, and content automatically. Social media automation tool for cont...

Security Scan

The skill's description and requested credentials (Instagram long‑lived token, YouTube OAuth) match its stated purpose, but it's only documentation: there is no run.sh or other code provided and the instructions expect you to create/run scripts and store credentials in files — this mismatch and the missing implementation are concerning and need clarification before use.

Purpose & Capability

Name and description match the operations described in SKILL.md (Instagram image posts and YouTube uploads). The credential types requested in the instructions (Facebook/Instagram tokens and YouTube OAuth) are appropriate for those platforms.

Instruction Scope

SKILL.md instructs users/agents to run {baseDir}/run.sh auth and post commands, and to create credential files under {baseDir}/credentials/. However no run.sh or implementation scripts are included in the package. The document also asks the agent/user to operate on local files (video paths) and credential files — reasonable for the purpose, but the absence of the scripts that would perform these actions is an incoherence and a potential risk if you obtain those scripts from an unknown source.

Install Mechanism

No install spec and no code files are present. That minimizes automatic installation risk, but also means the skill is only documentation; any code you run will have to come from elsewhere and should be inspected.

Credentials

The skill does not request environment variables or unrelated credentials. It asks for platform-specific OAuth tokens/credential files, which are proportional to the stated functionality. Note: it recommends storing tokens in files under {baseDir}/credentials — consider file permissions and secure storage.

Persistence & Privilege

always is false and model invocation is permitted (platform default). The skill does not request persistent system-wide privileges or modify other skills. The main concern is missing implementation rather than elevated privileges.

What to consider before installing

This package is documentation for a social-media automation tool, not an executable skill — there are no scripts included (no run.sh, instagram_poster.sh, or youtube_uploader.sh). Before using: 1) Ask the publisher for the actual implementation code or a trustworthy source (homepage/repo) and review that code yourself. 2) Never run scripts obtained from untrusted sources without auditing them; they could read or exfiltrate credentials or files. 3) If you create/store tokens as files, set strict filesystem permissions and prefer short-lived or scoped credentials where possible. 4) Prefer official OAuth flows and limit scopes (e.g., only content_publish). 5) If you want this skill to run in an agent, require the author to provide verifiable code and an install spec (or provide a vetted package) so you can audit what will run. If those things are not provided, treat the skill as incomplete and avoid running or sourcing third‑party run.sh scripts.

🚀 Social Media Suite - Automated Posting

Post to Instagram and YouTube automatically. Schedule and publish content without manual uploads. The free alternative to expensive tools like Buffer or Hootsuite – pay only for AI tokens, no monthly fees.

Use Cases

• Content Creators: Automate daily posting to grow your audience
• Marketing Teams: Schedule campaigns across multiple platforms
• Business Owners: Maintain consistent social presence without daily effort
• Agencies: Manage multiple client accounts efficiently

Key Features: Instagram image posting, YouTube video uploads, caption management, privacy settings, hashtag support, OAuth authentication.

Currently supported platforms:

• Instagram
• YouTube

---

1. Setup

Before you can use this skill, you need to set up credentials for each platform you want to use.

1.1 Instagram Setup

1. Prerequisites:

   • An Instagram account with Creator or Business status.
   • A Facebook Page connected to your Instagram account.
   • A Facebook App with the necessary permissions: instagram_basic, instagram_content_publish, pages_show_list, pages_read_engagement.
   • A long-lived User Access Token from your Facebook App.

2. Credential Files: Create the following files inside the {baseDir}/credentials/ directory:

   • instagram_user_access_token: Paste your long-lived User Access Token into this file.
   • instagram_account_id: Paste your Instagram Account ID into this file.

1.2 YouTube Setup

1. Prerequisites:

   • A Google Cloud Platform project with the YouTube Data API v3 enabled.
   • OAuth 2.0 credentials (client ID and client secret).

2. Authentication: Run the one-time authentication command to authorize the skill and generate your initial credentials:

   bash {baseDir}/run.sh auth --platform youtube
   

   Follow the on-screen instructions to log in with your Google account and grant permission. This will create a youtube_credentials.json file in the {baseDir}/credentials/ directory.

---

2. Usage

The primary command is post, which takes a platform and platform-specific arguments.

2.1 Post to Instagram

This command posts a single image with a caption to your Instagram account.

Command:

bash {baseDir}/run.sh post --platform instagram --image-url <url_to_image> --caption "Your caption here"

Parameters:

• --platform instagram: Specifies that the target is Instagram.
• --image-url <url_to_image>: Required. A public URL to the image you want to post. The image must be accessible from the internet.
• --caption "<text>": Required. The text caption for your post.

Example:

bash {baseDir}/run.sh post --platform instagram \
  --image-url "https://i.imgur.com/removed.png" \
  --caption "Just chilling with my OpenClaw agent! 🤖 #OpenClaw #AI #automation"

2.2 Post to YouTube

This command uploads a video file to your YouTube channel.

Command:

bash {baseDir}/run.sh post --platform youtube --file <path_to_video> --title "Title" --description "Description" [options]

Parameters:

• --platform youtube: Specifies that the target is YouTube.
• --file <path>: Required. The local path to the video file you want to upload.
• --title "<text>": Required. The title of the video (max 100 characters).
• --description "<text>": Required. The description of the video.
• --privacy <status>: Optional. The privacy status of the video. Can be public, unlisted, or private. (Default: private)
• --tags "<tag1,tag2>": Optional. Comma-separated list of tags for the video.

Example:

bash {baseDir}/run.sh post --platform youtube \
  --file "/home/user/videos/my_awesome_video.mp4" \
  --title "My First AI-Generated Video" \
  --description "Check out this cool video that my OpenClaw agent helped me create!" \
  --privacy "public" \
  --tags "AI,OpenClaw,automation,tech"

---

3. Credential Management

Refresh YouTube Token

The YouTube access token expires periodically. The script attempts to refresh it automatically, but you can also trigger a manual refresh if needed.

bash {baseDir}/run.sh auth --platform youtube --refresh

---

4. Scripts (for implementation)

This SKILL.md is the user-facing documentation. The actual logic would be implemented in a run.sh script that parses the arguments and calls the appropriate platform-specific logic.

A simplified run.sh might look like this:

#!/bin/bash
set -e

PLATFORM=""

# Parse platform first
if [ "$1" == "--platform" ]; then
    PLATFORM="$2"
    shift 2
fi

case $PLATFORM in
    instagram)
        # Execute instagram logic with remaining args: "$@"
        echo "Calling Instagram script with: $@"
        # ./instagram_poster.sh "$@"
        ;;
    youtube)
        # Execute youtube logic with remaining args: "$@"
        echo "Calling YouTube script with: $@"
        # ./youtube_uploader.sh "$@"
        ;;
    *)
        echo "Error: Unknown or missing platform. Use --platform [instagram|youtube]"
        exit 1
        ;;
esac