Social Poster

Post to social media via VibePost API. Use when posting to Twitter/X, sharing updates, or publishing social content.

This skill will post whatever text it is given to an external Replit-hosted API and includes a hardcoded API key inside the script. Before installing, consider the following: (1) The embedded API key is not declared and could allow anyone using the skill to post via that service — ask the author to remove the hardcoded key and require a user-owned key passed via an environment variable. (2) Verify the endpoint and operator (https://vibepost-jpaulgrayson.replit.app) — it's a personal/third-party host, not an official, known provider. (3) Do not send sensitive content through this skill until you trust the endpoint. (4) Prefer a version that documents required credentials in metadata and uses process environment variables (not embedded secrets). If you cannot confirm the maintainer or remove the embedded key, avoid installing or run it only with a disposable/test account.

Type: OpenClaw Skill Name: social-poster Version: 1.0.0 The skill is classified as suspicious primarily due to a critical vulnerability: a hardcoded API key (`API_KEY`) directly embedded in `scripts/post.mjs`. While the script's stated purpose is benign (posting to a social media API at `https://vibepost-jpaulgrayson.replit.app`), hardcoding sensitive credentials makes them easily discoverable and compromises security. There is no evidence of intentional malicious behavior like data exfiltration, unauthorized command execution, or prompt injection attempts against the agent.