Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent RelayAPI integration, but it gives an agent broad power to publish, delete, connect accounts, moderate messages, and change social-media configuration without clear confirmation rules.
Install only if you intend to let an agent operate connected social-media accounts through RelayAPI. Use a limited API key where possible, keep it in OpenClaw secrets, and require the agent to confirm before publishing, bulk posting, uploading local files, connecting or disconnecting accounts, deleting/unpublishing content, changing workspaces or queues, sending DMs/replies, or creating webhooks.
env:
- RELAYAPI_API_KEY
bins:
- curl
primaryEnv: RELAYAPI_API_KEY
emoji: "📡"
homepage: https://relayapi.devstorage_key="${media_url#https://media.relayapi.dev/}"
# PUT once using every exact header returned above
curl --fail-with-body -sS -X PUT "$upload_url" \
-H "Content-Type: $upload_content_type" \
-H "If-None-Match: $upload_precondition" \
--data-binary @photo.jpg# Confirm the object before attaching it (mandatory)
jq -n --arg storage_key "$storage_key" '{storage_key: $storage_key}' | \
curl --fail-with-body -sS -X POST https://api.relayapi.dev/v1/media/confirm \
-H "Authorization: Bearer $RELAYAPI_API_KEY" \
-H "Content-Type: application/json" \
--data-binary @-# Confirm the object before attaching it (mandatory)
jq -n --arg storage_key "$storage_key" '{storage_key: $storage_key}' | \
curl --fail-with-body -sS -X POST https://api.relayapi.dev/v1/media/confirm \
-H "Authorization: Bearer $RELAYAPI_API_KEY" \
-H "Content-Type: application/json" \
--data-binary @--H "Authorization: Bearer $RELAYAPI_API_KEY" # Filter by workspace curl "https://api.relayapi.dev/v1/accounts?workspace_id=ws_abc123" \ -H "Authorization: Bearer $RELAYAPI_API_KEY" # Accounts not assigned to a workspace
-H "Authorization: Bearer $RELAYAPI_API_KEY" # Accounts not assigned to a workspace curl "https://api.relayapi.dev/v1/accounts?ungrouped=true" \ -H "Authorization: Bearer $RELAYAPI_API_KEY" # Search by username
-H "Authorization: Bearer $RELAYAPI_API_KEY"
# Create workspace
curl -X POST https://api.relayapi.dev/v1/workspaces \
-H "Authorization: Bearer $RELAYAPI_API_KEY" \
-H "Content-Type: application/json" \
-d '{ "name": "Marketing Team", "description": "All brand accounts" }'-d '{ "name": "Marketing Team", "description": "All brand accounts" }'
# Update workspace
curl -X PATCH https://api.relayapi.dev/v1/workspaces/{workspace_id} \
-H "Authorization: Bearer $RELAYAPI_API_KEY" \
-H "Content-Type: application/json" \
-d '{ "name": "Rebranded Team" }'-d '{ "name": "Rebranded Team" }'
# Delete workspace (accounts are unassigned, not deleted)
curl -X DELETE https://api.relayapi.dev/v1/workspaces/{workspace_id} \
-H "Authorization: Bearer $RELAYAPI_API_KEY"
# Assign account to a workspace-H "Authorization: Bearer $RELAYAPI_API_KEY"
# Assign account to a workspace
curl -X PATCH https://api.relayapi.dev/v1/accounts/{account_id} \
-H "Authorization: Bearer $RELAYAPI_API_KEY" \
-H "Content-Type: application/json" \
-d '{ "workspace_id": "ws_abc123" }'# Facebook Pages
curl https://api.relayapi.dev/v1/accounts/{id}/facebook-pages \
-H "Authorization: Bearer $RELAYAPI_API_KEY"
curl -X PUT https://api.relayapi.dev/v1/accounts/{id}/facebook-pages \
-H "Authorization: Bearer $RELAYAPI_API_KEY" \
-d '{ "page_id": "123" }'-d '{ "page_id": "123" }'
# LinkedIn Organizations
curl https://api.relayapi.dev/v1/accounts/{id}/linkedin-organizations \
-H "Authorization: Bearer $RELAYAPI_API_KEY"
# Pinterest Boards-H "Authorization: Bearer $RELAYAPI_API_KEY"
# Pinterest Boards
curl https://api.relayapi.dev/v1/accounts/{id}/pinterest-boards \
-H "Authorization: Bearer $RELAYAPI_API_KEY"
# Reddit Subreddits & Flairs-H "Authorization: Bearer $RELAYAPI_API_KEY"
# Reddit Subreddits & Flairs
curl https://api.relayapi.dev/v1/accounts/{id}/reddit-subreddits \
-H "Authorization: Bearer $RELAYAPI_API_KEY"
curl https://api.relayapi.dev/v1/accounts/{id}/reddit-flairs \
-H "Authorization: Bearer $RELAYAPI_API_KEY"# Reddit Subreddits & Flairs
curl https://api.relayapi.dev/v1/accounts/{id}/reddit-subreddits \
-H "Authorization: Bearer $RELAYAPI_API_KEY"
curl https://api.relayapi.dev/v1/accounts/{id}/reddit-flairs \
-H "Authorization: Bearer $RELAYAPI_API_KEY"
# Google Business Locations# Returns: { "auth_url": "https://twitter.com/i/oauth2/authorize?..." }
# Step 2: After user authorizes, exchange the code
curl -X POST https://api.relayapi.dev/v1/connect/twitter \
-H "Authorization: Bearer $RELAYAPI_API_KEY" \
-H "Content-Type: application/json" \
-d '{ "code": "the_auth_code_from_callback" }'-H "Authorization: Bearer $RELAYAPI_API_KEY" # Platform overview for a specific account curl "https://api.relayapi.dev/v1/analytics/platform/overview?account_id=acc_abc123" \ -H "Authorization: Bearer $RELAYAPI_API_KEY" # Post-level metrics from the platform
-H "Authorization: Bearer $RELAYAPI_API_KEY" # Post-level metrics from the platform curl "https://api.relayapi.dev/v1/analytics/platform/posts?account_id=acc_abc123" \ -H "Authorization: Bearer $RELAYAPI_API_KEY" # Audience demographics
-H "Authorization: Bearer $RELAYAPI_API_KEY" # Audience demographics curl "https://api.relayapi.dev/v1/analytics/platform/audience?account_id=acc_abc123" \ -H "Authorization: Bearer $RELAYAPI_API_KEY" # Daily time series from platform
-H "Authorization: Bearer $RELAYAPI_API_KEY" # List posts with comment counts curl https://api.relayapi.dev/v1/inbox/comments/by-post \ -H "Authorization: Bearer $RELAYAPI_API_KEY" # Comments for a specific post
No suspicious patterns detected.