Social Media Automation

Manage multiple social media platforms to automate posting, scheduling, draft and template management, timeline viewing, interactions, and analytics via CLI.

What to check before installing/using this skill: - Inspect the config conflict: this package contains both social_media_automation/config.py and a social_media_automation/config/ package. That name collision can make Python import behavior unpredictable and may cause the skill to pick up different environment variables than you expect. Ask the author which module is intended, or test in an isolated environment. - Do not paste real high-privilege API keys into .env until you review the code. The code will read and also overwrite .env (OAuth flow saves access tokens back into .env). Keep credentials limited (use test/dev accounts when possible). - Search the code (integration/github_monitor.py, integration/bot_integration.py, content_generator) for any network calls, external endpoints, or automatic triggers. The SKILL.md doesn’t fully document those modules but they are present and may poll external services or auto-post. - Be aware the scheduler starts background jobs (per-minute checks) if PostScheduler is instantiated; this can lead to automatic posting if scheduled items exist or if auto_post is enabled in config. If you want only manual use, ensure auto_post is disabled and avoid instantiating the scheduler in long-running contexts. - Run the package in a disposable virtual environment or container, and verify which environment variable names are actually read (TWITTER_* vs X_*). Confirm OAuth flow behavior (it opens a browser and prompts for verifier) and where tokens are saved. - Prefer installing only after obtaining source provenance (this skill's registry 'source' and 'homepage' are unknown). If you can, ask the publisher for a repository link or signed release so you can audit changes and updates. What would change this assessment: if the maintainer clarifies and fixes the config-module/name collisions and env-name mismatches, documents (and optionally disables by default) any repo-monitoring/auto-posting features, and provides a clear provenance (repo/homepage), the risk profile would move toward benign. Conversely, evidence of hidden network exfiltration, undocumented endpoints, or automatic posting to third-party channels without explicit opt-in would increase the severity.

Type: OpenClaw Skill Name: social-media-automation Version: 0.1.1 The skill bundle is a legitimate and well-structured social media automation tool supporting platforms like X (Twitter), LinkedIn, and Bluesky. It includes comprehensive features for post scheduling, draft management, and template processing using standard libraries such as Tweepy, Pydantic, and Typer. Security-sensitive operations, such as media uploads in 'social_media_automation/core/content_manager.py', include appropriate file extension and size validation to prevent arbitrary file exfiltration, and configuration handling uses 'yaml.safe_load' to avoid execution risks. The integration features (GitHub monitoring and Discord/Telegram notifications) are aligned with the stated purpose of automating developer social media presence.