Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

GetPost AI and LLM Gateway

v1.0.0

Access 24+ LLM chat models and 16+ image/video generation models via one API.

0· 171·0 current·0 all-time
bydomm@dommholland

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for dommholland/getpost-ai.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "GetPost AI and LLM Gateway" (dommholland/getpost-ai) from ClawHub.
Skill page: https://clawhub.ai/dommholland/getpost-ai
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install getpost-ai

ClawHub CLI

Package manager switcher

npx clawhub@latest install getpost-ai
Security Scan
VirusTotalVirusTotal
Pending
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description (LLM + image/video gateway) matches the SKILL.md which shows curl examples against getpost.dev endpoints. That capability is coherent. However, the registry metadata declares no required credentials while the instructions explicitly require a gp_live_* API key, which is an inconsistency.
!
Instruction Scope
The SKILL.md limits runtime actions to curl calls against getpost.dev (signup, chat, generate, jobs). Those calls will transmit user prompts and any included content to an external provider — acceptable for an API client but a privacy/data-exfiltration concern. The instructions do not reference local files, system config, or other environment variables, but they also do not specify how the agent should securely store or reference the API key.
Install Mechanism
Instruction-only skill with no install spec and no code files; nothing is written to disk by the skill itself. This minimizes installation risk.
!
Credentials
Registry lists no required env vars or primary credential, yet SKILL.md requires an API key (Authorization: Bearer gp_live_YOUR_KEY). The skill should declare a primaryEnv or required env var so users and the agent know where to store the key. Because the skill will send data to an external endpoint, the lack of declared credential handling is a material omission.
Persistence & Privilege
always is false and the skill is user-invocable; it does not request persistent or system-level privileges and does not modify other skill configs.
What to consider before installing
This skill is basically a set of curl examples for the getpost.dev API. Before installing: (1) confirm getpost.dev is a legitimate/trusted provider and review its privacy/TOS and pricing, (2) assume everything you send (prompts, images, files) will be stored/processed by that third party — do not send secrets or PII, (3) do not reuse high-privilege API keys — create a dedicated key/account and limit its scope, (4) ask the skill author to declare the required env var (e.g., GETPOST_API_KEY) or otherwise document how the agent should securely store the key, and (5) if you need stronger guarantees about data handling, prefer an officially supported provider with clear docs and provenance. If you cannot verify the provider or the skill's provenance, treat it as risky.

Like a lobster shell, security has layers — review code before you run it.

latestvk97enyj4t86cw576tm1smxbmrx836pwc
171downloads
0stars
1versions
Updated 1mo ago
v1.0.0
MIT-0

GetPost AI API

Access 24+ LLM chat models and 16+ image/video generation models through a single API. OpenAI, Anthropic, Google, Grok, DeepSeek, Moonshot, Midjourney, and more.

Quick Start

# Sign up (no verification needed)
curl -X POST https://getpost.dev/api/auth/signup \
  -H "Content-Type: application/json" \
  -d '{"name": "YOUR_NAME", "bio": "What your agent does"}'
# Save the api_key from the response

Authentication

Authorization: Bearer gp_live_YOUR_KEY

Chat Completion

curl -X POST https://getpost.dev/api/ai/chat \
  -H "Authorization: Bearer gp_live_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model": "gpt-4.1-nano", "messages": [{"role": "user", "content": "Hello"}], "max_tokens": 100}'

Available Chat Models

gpt-5.4, gpt-4.1, gpt-4.1-nano, claude-opus-4-6, claude-sonnet-4-6, gemini-2.5-flash, grok-4, deepseek-chat, kimi-k2.5, and more. See all: GET /api/ai/models

Image Generation

curl -X POST https://getpost.dev/api/ai/generate \
  -H "Authorization: Bearer gp_live_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model": "gpt-image-1", "prompt": "A cat in space", "n": 1}'

Models: gpt-image-1, dall-e-3, midjourney, imagen-4, grok-imagine-image, stable-diffusion-3.5

Video Generation

curl -X POST https://getpost.dev/api/ai/generate \
  -H "Authorization: Bearer gp_live_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model": "sora-2", "prompt": "A timelapse of a flower blooming"}'

Models: sora-2, grok-imagine-video, veo-3.1. Returns job_id — poll GET /api/ai/jobs/{id} for result.

Full Docs

https://getpost.dev/docs/api-reference#ai

Comments

Loading comments...