← Back to Skills Marketplace
Postproxy
by
danbaranov
· GitHub ↗
· v0.1.0
1667
Downloads
0
Stars
3
Active Installs
2
Versions
Install in OpenClaw
/install postproxy
Description
Call PostProxy API to create and manage social media posts
Usage Guidance
This skill appears to be a simple PostProxy API wrapper, but take these precautions: (1) The SKILL.md requires POSTPROXY_API_KEY but the registry metadata doesn't declare it — confirm with the author before supplying credentials. (2) The examples show uploading local files (media[]=@/path/to/file); avoid giving the skill broad filesystem access or uploading sensitive files. (3) There is no source or homepage listed — try to verify the publisher and the service (https://app.postproxy.dev) and prefer using a scoped/limited API key or a test account. (4) If you install, start in a sandboxed environment and monitor network calls; revoke the key if behavior is unexpected.
Capability Analysis
Type: OpenClaw Skill
Name:
Developer:
Version:
Description: OpenClaw Agent Skill
The skill is classified as suspicious due to the combination of broad permissions and risky capabilities. It explicitly allows the AI agent to execute arbitrary Bash commands (`allowed-tools: Bash` in SKILL.md) and demonstrates the ability to upload any local file (`-F "media[]=@/path/to/image.jpg"` in SKILL.md) to the external API at `https://api.postproxy.dev`. While these capabilities are presented as part of the skill's stated purpose (managing social media posts), they represent significant attack surface for potential abuse, such as unauthorized file exfiltration or arbitrary command execution, if the agent were to be prompted maliciously.
Capability Assessment
Purpose & Capability
The SKILL.md describes exactly how to call the PostProxy API (endpoints, bearer auth, payloads) which is coherent with the name/description. However the registry metadata lists no required env vars/credentials while the instructions require POSTPROXY_API_KEY — a clear metadata/instruction mismatch that should be corrected.
Instruction Scope
The instructions instruct using curl with a Bearer token and include examples for multipart file uploads (e.g., -F "media[]=@/path/to/image.jpg"). That implies the agent will read local filesystem paths supplied to it. The SKILL.md also expects the POSTPROXY_API_KEY from the environment. The skill does not instruct collecting other unrelated system files, but the file-upload examples mean the agent may be asked to access arbitrary local files — a privacy/exfiltration risk if misused.
Install Mechanism
This is an instruction-only skill with no install spec and no code files, so nothing will be written to disk by an installer. That is the lowest-risk install model.
Credentials
Requesting a single service API key (POSTPROXY_API_KEY) is proportionate for an API client. The concern is that the registry metadata does not declare this required environment variable while the SKILL.md requires it — a mismatch that could cause users to unknowingly provide credentials. Additionally, because examples show uploading local files, a provided API key could be used to transmit files from the host if the agent is instructed to do so.
Persistence & Privilege
The skill does not request always: true, has no install behavior, and does not claim to modify other skills or system-wide settings. Normal autonomous invocation is enabled (platform default) and not in itself a red flag here.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install postproxy - After installation, invoke the skill by name or use
/postproxy - Provide required inputs per the skill's parameter spec and get structured output
Version History
v0.1.0
Initial release of postproxy skill.
- Allows users to interact with the PostProxy API to create and manage social media posts across multiple platforms.
- Provides detailed setup instructions, authentication requirements, and supported API endpoints.
- Supports creating posts, drafts, scheduling, publishing, deleting, and platform-specific post customization.
- Includes usage examples for JSON and file uploads.
v1.0.0
Initial release of the postproxy skill.
- Call the PostProxy API to create, schedule, draft, publish, and delete social media posts across major platforms (Facebook, Instagram, TikTok, LinkedIn, YouTube, Twitter/X, Threads).
- Supports listing profiles and posts, retrieving post details, and uploading media (both via URLs and local files).
- Supports platform-specific settings (e.g., Instagram Reels, YouTube titles, TikTok privacy).
- Requires API key setup using the POSTPROXY_API_KEY environment variable.
Metadata
Frequently Asked Questions
What is Postproxy?
Call PostProxy API to create and manage social media posts. It is an AI Agent Skill for Claude Code / OpenClaw, with 1667 downloads so far.
How do I install Postproxy?
Run "/install postproxy" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Postproxy free?
Yes, Postproxy is completely free (open-source). You can download, install and use it at no cost.
Which platforms does Postproxy support?
Postproxy is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Postproxy?
It is built and maintained by danbaranov (@danbaranov); the current version is v0.1.0.
More Skills