ClawHub

Boring Facebook Publisher

v1.0.4

Publish posts to Facebook Pages using Boring. Use when the user says 'post to Facebook', 'publish on FB', 'schedule Facebook post', 'manage Facebook schedule...

⭐ 0· 83·0 current·0 all-time
by@snoopyrain
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
medium confidence
ℹ
Purpose & Capability
The skill's stated purpose (publish/schedule Facebook Page posts) matches the runtime instructions (list accounts, upload media, publish/schedule). However, registry metadata lists no primary credential while the SKILL.md requires an MCP Connector link (a URL that embeds an auth token); this is a metadata inconsistency but not a functional mismatch — the MCP link is the actual credential the skill needs.
ℹ
Instruction Scope
Instructions are scoped to posting workflows (list accounts, prepare media, publish/schedule, manage scheduled posts). They explicitly require uploading local files or remote URLs to Boring's Google Cloud Storage so media is publicly accessible for Facebook — this is expected for a publishing service but is a privacy/data-flow concern because local files are transmitted off your device to a third party.
✓
Install Mechanism
No install spec or code files are included (instruction-only). This minimizes disk write/execution risk; there is nothing to download or run locally from unknown URLs.
ℹ
Credentials
The skill requests no environment variables or local secrets, but it does require an MCP Connector link which embeds an auth token and functions as the credential. That is proportional to the stated purpose, but the registry claims 'no primary credential' which contradicts the SKILL.md. Treat the MCP link like a password.
✓
Persistence & Privilege
The skill is not always-enabled and does not request elevated platform privileges. Model-driven autonomous invocation is allowed (the platform default) but not, by itself, an extra red flag here.
Assessment
This skill appears to do what it says: it posts to Facebook Pages via the Boring service. Before installing: (1) Understand that your 'MCP Connector' URL contains an embedded auth token and grants Boring access to act on your Pages — do not paste it in public channels. (2) Media files you provide (local or URLs) will be uploaded to Boring's Google Cloud Storage and transmitted to Facebook; avoid uploading highly sensitive files. (3) Verify the Boring service (boring.aiagent-me.com) and its privacy/security policies and consider using a page/account with limited permissions for initial testing. (4) Note the registry metadata mismatch (it lists no primary credential while the SKILL.md requires the MCP link) — ask the publisher to clarify how the connector is supplied/stored if you need stronger assurance. If you are uncomfortable with third-party hosting of media or with handing an embedded token to a connector, do not install or use this skill.

Like a lobster shell, security has layers — review code before you run it.

latestvk974mxmyj8tfcex8pdfzwspfax83p30h

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

📘 Clawdis
ConfigMCP Connector link from boring.aiagent-me.com (contains embedded auth token)

Comments