Postiz Litiao

Postiz is a tool to schedule social media and chat posts to 28+ channels X, LinkedIn, LinkedIn Page, Reddit, Instagram, Facebook Page, Threads, YouTube, Goog...

This package appears to be a legitimate CLI wrapper for the Postiz API and only needs the Postiz API key and optionally a custom API URL. Before installing or adding the API key to your shell profile: (1) treat POSTIZ_API_KEY like any secret — avoid committing it to repos or exposing it in shared machines, (2) prefer using environment-specific secret storage (e.g., CI secrets, OS credential store) instead of adding to ~/.bashrc if you care about leakage, and (3) verify the upstream npm/github project (links in SKILL.md) to confirm you trust the publisher before running global npm installs or linking binaries.

Type: OpenClaw Skill Name: postiz-litiao Version: 1.0.0 The skill bundle provides comprehensive documentation, shell examples, and JSON templates for the Postiz CLI, a legitimate social media automation tool. The instructions in SKILL.md are well-structured to guide an AI agent through workflows such as integration discovery, media uploading, and multi-platform post scheduling. While the bundle includes a recommendation to use an external tool (agent-media), this appears to be a functional suggestion within the same ecosystem (Gitroom/Postiz) rather than a malicious prompt injection. No evidence of data exfiltration, unauthorized execution, or persistence mechanisms was found.