Social Autopilot

Autonomously manage and post varied, platform-optimized social media content across X, Instagram, YouTube, and Meta using smart scheduling and data-driven th...

This skill appears to implement what it claims (autonomous posting, video generation, R2 hosting), but there are important things to check before installing or providing credentials: 1) Metadata mismatch: The registry metadata omits required environment variables while SKILL.md and the code require many sensitive tokens. Treat the SKILL.md and the code as the source of truth. 2) Run in a sandbox: Test the skill in an isolated environment (VM or container) and a Python virtualenv so you can safely install dependencies and inspect behavior without exposing your main accounts. 3) Use dedicated, limited-scope accounts/tokens: Create test or throwaway social accounts and R2 bucket and generate tokens with the minimum permissions needed (posting/upload only if possible). Avoid giving long-lived or primary-business account tokens until you trust the code. 4) Inspect and test dry-run first: Use the skill's dry-run option and review generated outputs (videos, captions) before letting it post. Verify mark_as_posted updates only the intended CSV and that no unexpected network calls occur. 5) Review OAuth and secrets handling: YouTube uses an OAuth client_secrets.json and browser flow — confirm where that file is stored and that it isn't uploaded anywhere. The code loads .env (load_dotenv) — ensure your .env doesn't contain unrelated secrets. 6) Check logging and cleanup: Logs may record filenames and public URLs; avoid printing full tokens. Be prepared to rotate any tokens used for testing. 7) Verify provenance: The README and clawhub.json reference a GitHub repo (abhinawtech/social-autopilot). If possible, pull the code directly from a verifiable upstream repository (review commit history, issues) rather than trusting an anonymous package snapshot. If you want, I can help by listing exact files and lines to inspect for network endpoints or by generating a checklist of minimum token scopes for each platform.

Type: OpenClaw Skill Name: social-autopilot Version: 1.4.0 The skill bundle is a comprehensive social media automation engine for X, Instagram, YouTube, and Meta, requiring extensive API credentials and environment variables. It performs several high-risk operations, including broad network access, file system manipulation for media generation, and the execution of a headless browser (Chromium) with the '--no-sandbox' flag via the html2image library in scripts/html_video_generator.py. Additionally, scripts/yt_auth.py uses pickle.load to manage YouTube OAuth tokens, which is a known security risk for arbitrary code execution if the local file is compromised. While these capabilities are plausibly necessary for the stated purpose of autonomous social media management, the combination of high-privilege requirements and risky execution patterns warrants a suspicious classification.