← Back to Skills Marketplace
382
Downloads
2
Stars
2
Active Installs
1
Versions
Install in OpenClaw
/install typefully-skill
Description
Create, schedule, list, edit, and delete drafts on Typefully. Supports single tweets, threads, and multi-platform posts (X, LinkedIn, Threads, Bluesky, Masto...
Usage Guidance
This skill appears to implement exactly what it says (managing Typefully drafts) and its code only talks to api.typefully.com, but the registry metadata omits the required API key. Before installing: 1) Verify the skill source (check the GitHub homepage and confirm the repo and author). 2) Confirm you are comfortable granting TYPEFULLY_API_KEY — this key allows creating, scheduling, editing, and deleting posts (including publishing immediately). Prefer creating a key with minimal scope or be ready to revoke it. 3) Test with read-only commands first (list-social-sets, list-drafts) to confirm expected behavior. 4) Ask the skill publisher to update the registry metadata to declare TYPEFULLY_API_KEY and TYPEFULLY_SOCIAL_SET_ID so automated systems and other reviewers are not misled. If you plan to allow autonomous agent actions, be explicit in policy about 'publish_at: "now"' since the agent could publish content immediately.
Capability Analysis
Type: OpenClaw Skill
Name: typefully-skill
Version: 1.0.0
The OpenClaw Typefully skill is benign. It provides functionality to manage Typefully drafts via its API, as described in SKILL.md and README.md. The `scripts/typefully.sh` script uses `curl` for API interaction and `python3` for JSON parsing and robust input sanitization (`json.dumps`) to prevent injection vulnerabilities. It retrieves API keys from environment variables or the `pass` utility, which is a standard and expected practice for a skill requiring authentication. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, prompt injection attempts in SKILL.md, or obfuscation. All actions are aligned with the stated purpose.
Capability Assessment
Purpose & Capability
The skill name/description (manage Typefully drafts: create, schedule, list, edit, delete) matches the included script and SKILL.md. However, the registry metadata in the provided manifest lists no required environment variables or primary credential, while SKILL.md and scripts/typefully.sh clearly require TYPEFULLY_API_KEY (and optionally TYPEFULLY_SOCIAL_SET_ID). This mismatch is an integrity/metadata concern (likely an authoring or packaging oversight) but not, by itself, evidence of malicious intent.
Instruction Scope
SKILL.md and scripts/typefully.sh confine actions to Typefully's v2 API (https://api.typefully.com/v2). The script only reads TYPEFULLY_API_KEY (or a specific pass store entry) and TYPEFULLY_SOCIAL_SET_ID (or a specific pass entry), performs HTTP calls to the Typefully API, and prints JSON. It does not read arbitrary files, send data to unrelated endpoints, or perform hidden/background tasks. It does invoke 'pass' when used, but only for the explicit keys 'typefully/api-key' and 'typefully/social-set-id'.
Install Mechanism
There is no install spec — this is instruction-only with an included shell script. Nothing is downloaded from external or untrusted URLs during install. The included script is plain shell; no archive downloads, no brew/npm installs are invoked by the skill itself.
Credentials
The actual runtime requires TYPEFULLY_API_KEY (and optionally TYPEFULLY_SOCIAL_SET_ID); those are proportional to the stated purpose. The concern is that the registry metadata lists 'Required env vars: none' and 'Primary credential: none' which is inconsistent with SKILL.md/scripts. This mismatch could lead users or automated systems to install the skill without realizing it needs an API key, or to grant credentials incorrectly. No unrelated secrets or broad system credentials are requested by the script.
Persistence & Privilege
The skill does not request always:true and does not modify other skills or system-wide agent settings. It can be invoked autonomously (disable-model-invocation is false) which is normal; note that autonomous invocation plus a provided API key gives the agent the ability to create/schedule/publish social posts on your behalf — this is expected for a posting skill but worth explicit user consideration.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install typefully-skill - After installation, invoke the skill by name or use
/typefully-skill - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Initial release: create/edit/schedule/delete Typefully drafts, threads, multi-platform (X, LinkedIn, Threads, Bluesky, Mastodon). Input validation, dynamic social_set_id, proper error handling.
Metadata
Frequently Asked Questions
What is Typefully Skill?
Create, schedule, list, edit, and delete drafts on Typefully. Supports single tweets, threads, and multi-platform posts (X, LinkedIn, Threads, Bluesky, Masto... It is an AI Agent Skill for Claude Code / OpenClaw, with 382 downloads so far.
How do I install Typefully Skill?
Run "/install typefully-skill" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Typefully Skill free?
Yes, Typefully Skill is completely free (open-source). You can download, install and use it at no cost.
Which platforms does Typefully Skill support?
Typefully Skill is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Typefully Skill?
It is built and maintained by chapati (@chapati23); the current version is v1.0.0.
More Skills