Daily Social Media Publisher

Daily social media posting with NewsAPI for PayLessTax & LevelUpLove

Security Scan

The skill's declared purpose (automated social posting) matches the code, but there are several mismatches between the manifest, SKILL.md, and the actual code/configs that reduce trust and require manual checks before use.

Purpose & Capability

The name/description and the index.py implementation are consistent: the code fetches NewsAPI content, generates images via a templated.io endpoint, and posts via an UploadPost-style API. However, the registry metadata declares no required env vars or primary credential while SKILL.md documents multiple API keys (NEWS_API_KEY, UPLOADPOST_API_KEY, TEMPLATED_IO_KEY). That mismatch (manifest says 'none' but the skill clearly needs API credentials) is an incoherence to investigate.

Instruction Scope

The SKILL.md instructions are scoped to fetching news, generating images, and posting content. The runtime code uses only network calls to the described services and reads only provided config/oneliner files. The instructions mention scheduling triggers (OpenClaw) but scheduling itself is external; the skill's code does not attempt to read unrelated system files or extra environment variables. One minor discrepancy: SKILL.md language sometimes says 'scrape' but the code uses the NewsAPI API (not web scraping).

Install Mechanism

There is no install spec (instruction-only plus a single Python file). Nothing is downloaded or installed automatically by the skill package — lowest install risk.

Credentials

SKILL.md and index.py both rely on API credentials and config files, but the package metadata lists no required environment variables or primary credential. Additionally, SKILL.md shows env-var-style names for API keys, while index.py expects CLI args and JSON config files containing api_key fields. Config path values embedded in the provided config JSONs (e.g., oneliners_file: "data/oneliners/...") do not match the actual oneliners/ directory in the package. These mismatches increase the chance of misconfiguration and could lead users to inadvertently supply secrets in the wrong place.

Persistence & Privilege

The skill does not request permanent/always-on inclusion (always:false) and does not modify other skills or system-wide settings. It will run network calls when invoked and can be invoked autonomously (platform default), which is expected for a posting skill.

What to consider before installing

This skill appears to implement the advertised social-posting workflow, but there are configuration and declaration mismatches you should resolve before installing: - Credentials and configs: SKILL.md documents API keys (NewsAPI, Templated.io, UploadPost) but the registry shows no required env vars. Decide where secrets must be provided (CLI args, config JSONs, or env vars) and avoid pasting keys into an unclear location. Prefer using a config file passed explicitly or environment variables that your runtime environment controls. - Config paths: The included config JSONs reference paths like data/oneliners/... whereas the repository provides oneliners/*.json. Confirm which file paths the running agent will use to avoid silent failures or accidental default behavior. - Endpoints: The code defaults to posted endpoints (api.templated.io and api.upload-post.com). Verify these endpoints are correct and trustworthy before handing over credentials. - Scheduling & posting frequency: SKILL.md suggests frequent automatic posting (every 2–3 hours). Ensure you want that behavior and that it won't violate platform rules or rate limits. - Testing: Run the script in a controlled environment with test API keys / sandbox endpoints first, and inspect the output JSON (it writes a post_result file). Check that the tool only sends data to expected endpoints and that no unexpected data (system files, other credentials) are read or transmitted. If you want to proceed, ask the publisher for clarified installation instructions (where to provide API keys) and for corrected example config files that match the shipped file layout.

Social Media Publisher Skill

Overview

Automated daily social media posting system that generates content using NewsAPI and UploadPost API with Templated.io image rendering.

Purpose

• Fetch industry news via NewsAPI
• Generate branded image posts using Templated.io
• Publish to social platforms via UploadPost API
• Schedule daily posts for LevelUpLove and PayLessTax

Input Variables

Variable	Description	Example
NEWS_API_KEY	NewsAPI.org key	92a8bbc150d...
UPLOADPOST_API_KEY	UploadPost API key	from uploadpost.json
TEMPLATED_IO_KEY	Templated.io API key	from templated_io.json
BRAND	Which brand to post	"paylesstax" or "leveluplove"
CONTENT_TYPE	Post type	"news" or "onerliner"
PLATFORM	Where to post	"instagram", "facebook", "twitter"

Content Types

News-Based Posts

1. Scrape latest news via NewsAPI (tax for PayLessTax, relationship for LevelUpLove)
2. Summarize headline
3. Generate image via Templated.io
4. Post via UploadPost API
5. Schedule next post

One-Liner Pool Posts

• Rotate through hand-written one-liners from JSON pool
• Quick generation, no external news fetch
• Fast turnaround for high-frequency posting

One-Liner Pools

PayLessTax Topics:

• Tax deadline reminders
• VAT compliance tips
• Penalty warnings
• Professional services CTA

LevelUpLove Topics:

• Dating advice
• Relationship tips
• Gaming/streaming culture
• Engagement questions

Triggers

Scheduled through OpenClaw:

• PayLessTax: Every 2 hours during business hours (06:00-18:00)
• LevelUpLove: Every 3 hours (09:00, 12:00, 15:00, 18:00, 21:00)

APIs & Dependencies

• NewsAPI.org: Fresh content headlines
• Templated.io: Image generation via templates
• UploadPost API: Social media publishing
• requests: HTTP client
• Pillow: Image manipulation (fallback)

Image Rendering Flow

1. Select template from config (paylesstax_ig_post, leveluplove_ig_post)
2. Replace text layer with news headline or one-liner
3. Render to PNG via Templated.io
4. Download and confirm
5. Upload via UploadPost

Config Files Required

paylesstax_oneliners.json

[
  "Miss the 2026 deadline? Penalties apply automatically.",
  "VAT compliance made simple: We're the shortcut you need."
]

uploadpost.json

{
  "api_key": "...",
  "endpoint": "https://api.upload-post.com/api/upload_photos"
}

templated_io.json

{
  "api_key": "...",
  "templates": {
    "paylesstax": {"template_id": "tpl_xxx"},
    "leveluplove": {"template_id": "tpl_yyy"}
  }
}

Output

{
  "brand": "paylesstax",
  "content_type": "news",
  "headline": "SARS Extends Tax Deadline",
  "image_url": "https://...",
  "post_id": 12345,
  "status": "published",
  "scheduled_next": "2026-03-04T08:00:00"
}

Files

• index.py - Main posting logic
• onliners/paylesstax.json - One-liner pool
• onliners/leveluplove.json - One-liner pool
• config/uploadpost.example.json - Template config
• config/templated_io.example.json - Template config