Misskey

Misskey API integration for posting notes and uploading media to Misskey/Fediverse instances. Use when users want to post to Misskey, upload images, or inter...

Security Scan

The skill appears to implement Misskey posting/uploading as described, but its metadata omits required environment variables and the scripts use shell eval and implicit binaries (curl/python3), which is an incoherence and a minor risk.

Purpose & Capability

The name/description (Misskey posting and uploads) matches the included scripts (post, upload, delete, whoami) and the API endpoints they call.

Instruction Scope

Runtime instructions and scripts only reference MISSKEY_HOST, MISSKEY_TOKEN, files provided by the user, and standard API endpoints. They do not attempt to read unrelated system files. However, upload.sh builds a curl command string and uses eval to run it (unnecessary and risky if arguments are malicious), and post.sh/whoami.sh call python3 for JSON parsing—so the agent will invoke network calls and spawn local processes.

Install Mechanism

No install spec (instruction-only with included scripts); nothing is downloaded or written by an installer. This is low-install risk.

Credentials

The skill actually requires MISSKEY_HOST and MISSKEY_TOKEN (and implicitly curl and python3) to function, but the registry metadata lists no required env vars or binaries. That mismatch is an incoherence the user should be aware of. The use of a default HOST (https://maid.lat) if MISSKEY_HOST is unset means actions could be sent to that instance unintentionally.

Persistence & Privilege

The skill does not request permanent/always presence, does not modify other skills or agent settings, and has normal autonomous-invocation settings.

What to consider before installing

This skill implements exactly what it says (posting, uploading, deleting, whoami) but the package metadata omitted required environment variables and expected binaries. Before installing: 1) be prepared to set MISSKEY_HOST and MISSKEY_TOKEN (the scripts default to https://maid.lat if you forget); 2) ensure curl and python3 are available; 3) inspect or replace upload.sh's use of eval (it can be exploited if used with untrusted input) — a safer direct curl invocation is preferable; 4) don't expose a high-privilege token: create a token with minimal permissions and never commit it to version control; and 5) if you require stronger assurance, ask the publisher to update the registry metadata to declare MISSKEY_HOST/MISSKEY_TOKEN and required binaries, and to remove eval usage.

Misskey API

Post notes and upload images to Misskey/Fediverse instances.

Configuration

Set environment variables or create a config file:

# Misskey instance URL
export MISSKEY_HOST="https://your-instance.misskey.io"
# API Token (get from Settings > API)
export MISSKEY_TOKEN="your-token-here"

Getting a Token:

1. Login to your Misskey instance
2. Go to Settings > API > Access Tokens
3. Create a new token with required permissions

Popular Misskey Instances

Instance	URL	Description
maid.lat	https://maid.lat	メイド情報局 - A Misskey instance for maid lovers
misskey.io	https://misskey.io	Official Misskey instance
misskey.design	https://misskey.design	For designers

Posting

Send Text

MISSKEY_HOST="https://maid.lat" MISSKEY_TOKEN="xxx" \
  bash ~/.openclaw/workspace/skills/misskey/scripts/post.sh "Hello, Fediverse!"

Send with Image

MISSKEY_HOST="https://maid.lat" MISSKEY_TOKEN="xxx" \
  bash ~/.openclaw/workspace/skills/misskey/scripts/post.sh "Image caption" "/path/to/image.png"

Send Multiple Images

MISSKEY_HOST="https://maid.lat" MISSKEY_TOKEN="xxx" \
  bash ~/.openclaw/workspace/skills/misskey/scripts/post.sh "Multiple images" "/path/to/img1.png" "/path/to/img2.png"

Upload Image

Upload image to drive separately:

MISSKEY_HOST="https://maid.lat" MISSKEY_TOKEN="xxx" \
  bash ~/.openclaw/workspace/skills/misskey/scripts/upload.sh "/path/to/image.png"

Visibility Options

Add visibility parameter after text:

# Public (default)
bash post.sh "Content" --visibility public

# Home timeline only
bash post.sh "Content" --visibility home

# Followers only
bash post.sh "Content" --visibility followers

# Specified users
bash post.sh "Content" --visibility specified --visible-user-ids "user-id"

Content Warning (CW)

bash post.sh "Hidden content" --cw "Content warning title"

Delete Note

MISSKEY_HOST="https://maid.lat" MISSKEY_TOKEN="xxx" \
  bash ~/.openclaw/workspace/skills/misskey/scripts/delete.sh "note-id"

Get note ID from URL: https://maid.lat/notes/ak4lrcfalen102bc → ID is ak4lrcfalen102bc

API Endpoints

Endpoint	Method	Description
/api/notes/create	POST	Create note
/api/notes/delete	POST	Delete note
/api/drive/files/create	POST	Upload file
/api/i	POST	Get current user info

Error Handling

Status	Meaning
401	Invalid or expired token
400	Invalid parameters
429	Rate limited

Scripts

Script	Description
post.sh	Create notes with optional images
delete.sh	Delete notes by ID
upload.sh	Upload files to drive
whoami.sh	Display current user info