← Back to Skills Marketplace
Postproxy
by
danbaranov
· GitHub ↗
· v0.1.0
1528
Downloads
2
Stars
1
Active Installs
1
Versions
Install in OpenClaw
/install postproxy-skill
Description
Call PostProxy API to create and manage social media posts
Usage Guidance
This skill appears to do what it says (call the PostProxy API), but the manifest omits the required POSTPROXY_API_KEY and the runtime instructions allow uploading local files to an external service. Before installing: (1) only set POSTPROXY_API_KEY in the agent environment if you trust the skill/source; (2) be aware that using the skill or allowing the model to invoke it may cause local files referenced by the agent to be uploaded to PostProxy; (3) if you want to prevent autonomous use, disable model invocation for the skill or avoid placing the API key in the agent environment; (4) prefer skills with matching declared requirements and a known/trusted source. If you need higher assurance, ask the publisher to update the manifest to declare POSTPROXY_API_KEY and to document file-upload behavior and invocation constraints.
Capability Analysis
Type: OpenClaw Skill
Name: postproxy-skill
Version: 0.1.0
The skill is classified as suspicious due to the presence of high-risk capabilities, specifically `allowed-tools: Bash` and the ability to upload local files (`-F "media[]=@/path/to/image.jpg"`) to an external API (api.postproxy.dev) as demonstrated in SKILL.md. While these capabilities are plausibly needed for the stated purpose of managing social media posts with media, they grant broad shell access and file read/exfiltration potential to a third-party service, which constitutes a significant risk without clear malicious intent from the skill developer.
Capability Assessment
Purpose & Capability
The SKILL.md describes calling the PostProxy API to manage social posts, which matches the skill name and description. However, the package metadata declared no required environment variables or primary credential while the instructions explicitly require POSTPROXY_API_KEY — a manifest/instructions mismatch.
Instruction Scope
Instructions are concrete curl examples covering listing, creating, scheduling, publishing, and deleting posts and include multipart file uploads from local paths (media[]=@/path/to/image.jpg). That is coherent with the purpose but has privacy implications: local files referenced by the agent could be uploaded to an external service. The SKILL.md also uses an $ARGUMENTS placeholder (open-ended) which could cause broader input being sent to the API if not constrained.
Install Mechanism
Instruction-only skill with no install spec or code files; nothing is written to disk by an installer. This is the lowest-risk install model.
Credentials
The skill requires a single service credential (POSTPROXY_API_KEY) in the instructions, which is proportionate to the stated purpose. But the registry metadata did not declare this required env var or a primary credential, creating an inconsistency. Also, having that API key available to the agent allows the skill to act on behalf of the user (including uploading content), so users should ensure the key is only set when they intend to allow those operations.
Persistence & Privilege
The skill does not set always:true (good) but also does not disable model invocation, meaning the model could call it autonomously and use any POSTPROXY_API_KEY present in the environment. That combination (model-invocable + access to an external API key) increases risk of unexpected API calls.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install postproxy-skill - After installation, invoke the skill by name or use
/postproxy-skill - Provide required inputs per the skill's parameter spec and get structured output
Version History
v0.1.0
Initial release of postproxy-skill for managing social media posts via PostProxy API.
- Supports creating, listing, retrieving, and deleting posts across multiple platforms (Facebook, Instagram, TikTok, LinkedIn, YouTube, Twitter/X, Threads).
- Allows media uploads, scheduled posting, and draft creation/publishing.
- Supports platform-specific parameters (e.g., Instagram reels, YouTube privacy).
- Requires API key in environment variable POSTPROXY_API_KEY for authentication.
- Includes detailed usage examples for all major endpoints.
Metadata
Frequently Asked Questions
What is Postproxy?
Call PostProxy API to create and manage social media posts. It is an AI Agent Skill for Claude Code / OpenClaw, with 1528 downloads so far.
How do I install Postproxy?
Run "/install postproxy-skill" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Postproxy free?
Yes, Postproxy is completely free (open-source). You can download, install and use it at no cost.
Which platforms does Postproxy support?
Postproxy is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Postproxy?
It is built and maintained by danbaranov (@danbaranov); the current version is v0.1.0.
More Skills