Automatically generate and post optimized social media content promoting GitHub bounty campaigns using repo data and custom messages.

This skill is inconsistent: it advertises automatic multi-platform posting but the code only reads a GitHub repo and prints a composed message. Before running or providing any credentials: (1) don't supply API tokens until you audit the code — the registry didn't declare required env vars but the script reads GITHUB_TOKEN via dotenv; (2) verify and fix the invocation (the script doesn't parse --repo/--platform flags as shown); (3) if you need actual posting, inspect or implement the platform-specific APIs yourself rather than trusting this package; (4) run npm install and execute only in a sandboxed environment or CI runner you control; (5) review package-lock for suspicious third-party packages and consider pinning or replacing dependencies. Because of these mismatches and missing documentation, treat the package as untrusted until you confirm its behavior and provenance.

Type: OpenClaw Skill Name: autopost-github-bounty Version: 1.0.0 The skill bundle exhibits strong indicators of a potential supply chain attack. The package-lock.json file specifies versions for several popular libraries (axios 1.15.0, dotenv 16.6.1, and follow-redirects 1.15.11) that are significantly higher than the current official releases, a technique often used in dependency confusion attacks. Additionally, the _meta.json file contains a future-dated timestamp (2026). While the autopost.js script itself is functionally benign and lacks explicit malicious logic, the anomalous environment configuration suggests an intent to trigger the installation of potentially compromised third-party packages during the 'npm install' step.