Posta

Post to Instagram, TikTok, LinkedIn, YouTube, X/Twitter, Facebook, Pinterest, Threads and Bluesky from your terminal. Create posts with AI-generated images a...

This skill appears to do what it claims: manage Posta accounts and optionally call AI services for content. Before installing: 1) Only provide POSTA_API_TOKEN if you trust the Posta service; tokens are cached in /tmp for the session so revoke them if exposed. 2) Be aware the helper reads ~/.posta/credentials and .env/.env.local/.env.production in the working directory for exact variable names (it will not read other files), so avoid storing unrelated secrets in those files in projects you use with this skill. 3) The docs inconsistently mention searching shell profiles; in practice the shipped script does not read ~/.bashrc or ~/.zshrc — verify the version you install if this matters. 4) If you enable AI generation, you’ll need to supply FIREWORKS_API_KEY / GEMINI_API_KEY / OPENAI_API_KEY and the skill will make network calls to those external APIs. 5) Review the GitHub source (homepage) if you want additional assurance; revoke any tokens you test with if you suspect exposure.

Type: OpenClaw Skill Name: posta Version: 1.2.2 The 'posta' skill is a social media management tool designed to interact with the Posta API. It provides comprehensive bash helper functions in 'scripts/posta-api.sh' for managing posts, media, and analytics across multiple platforms. The skill includes proactive security measures, such as SSRF protection for URL-based media uploads and a credential discovery mechanism that is restricted to specific files (~/.posta/credentials, .env) and specific variable names. The instructions in 'SKILL.md' emphasize user confirmation and safety, and no evidence of malicious behavior, data exfiltration, or unauthorized execution was found.