← 返回 Skills 市场

Buffer Social Media

Name: Buffer Social Media
Author: ahmadabugosh

作者 Ahmad Abugosh · GitHub ↗ · v1.0.0

cross-platform ⚠ suspicious

349

总下载

当前安装

版本数

在 OpenClaw 中安装

/install buffer-social

功能描述

Create, schedule, queue, and manage social media posts and drafts across Buffer-connected profiles using terminal commands.

使用说明 (SKILL.md)

Buffer Skill for OpenClaw

Use this skill to create and manage Buffer content from OpenClaw or terminal commands.

Quick Start

Install dependencies:
```
cd skills/buffer
npm install
```

Configure API key:

cp .env.example .env
# set BUFFER_API_KEY

Run a command:
```
node ./buffer.js profiles
```

Authentication Setup

Set in .env:

BUFFER_API_KEY=your_buffer_api_key
BUFFER_API_URL=https://api.buffer.com/graphql

Get key: https://publish.buffer.com/settings/api

Command Reference

`buffer profiles`

List all connected profiles.

`buffer post \x3Ctext>`

Create content.

Options:

--profile \x3Cid>: single target profile
--profiles \x3Cids>: comma-separated profile IDs
--all: all connected profiles
--time \x3Cdatetime>: ISO 8601 scheduled time
--queue: add to queue
--image \x3Cpath>: attach local image path (validated; upload flow limited by current API docs)
--draft: save as idea/draft instead of post

`buffer queue`

View scheduled/queued posts.

Options:

--profile \x3Cid>: filter by profile
--limit \x3Cn>: max results

`buffer ideas`

List saved ideas.

Options:

--limit \x3Cn>: max results

Common Use Cases

# Post to one profile
node ./buffer.js post "Just shipped 🚀" --profile \x3Cid>

# Schedule for tomorrow
node ./buffer.js post "Tomorrow update" --profile \x3Cid> --time "2026-03-03T14:00:00Z"

# Multi-channel post
node ./buffer.js post "New blog live" --profiles id1,id2

# Save draft
node ./buffer.js post "Draft concept" --profile \x3Cid> --draft

Troubleshooting

Auth errors (401/403): check BUFFER_API_KEY, regenerate key if needed.
Rate limits (429): wait ~60s and retry.
Invalid date: use ISO format like 2026-03-03T14:00:00Z.
Image path error: verify file exists and path is correct.

OpenClaw Integration Examples

“Post to Buffer: Just shipped a new feature! 🚀 to profile \x3Cid>”
“Queue this in Buffer for all profiles: Weekly recap is live”
“Save this as Buffer draft for profile \x3Cid>: Campaign angle #3”

安全使用建议

This skill appears to be a legitimate Buffer CLI implementation, but there are important inconsistencies you should address before installing: 1) Metadata vs reality: the registry metadata does NOT declare the BUFFER_API_KEY env var or an install step, yet SKILL.md and code require you to run 'npm install' and set BUFFER_API_KEY in .env. Treat that as a red flag — confirm the skill's source and intent with the publisher before running it. 2) Verify origin: the skill lists no homepage and the registry owner ID is unfamiliar. Prefer skills with a public repository or homepage you can review. If you still want to use it, inspect the repository contents (package.json, package-lock.json) locally before running npm install. 3) Run safely: if you must try it, do so in a restricted environment (ephemeral VM or container) and do not use high-privilege or broadly-scoped secrets. Create a Buffer API key with the least privilege possible (or a throwaway account) and keep it separate from other production keys. 4) Audit dependencies and network: run 'npm audit' and review package-lock integrity. Review buffer-api.js to confirm all outgoing requests are to Buffer domains and that no other unexpected endpoints exist. 5) Rotate keys if needed: if you exposed an API key while testing with an unknown skill, rotate/revoke it immediately. If the publisher can update the registry metadata to declare BUFFER_API_KEY and note the required npm install step (or provide a trusted homepage/repo), that would significantly reduce the concern.

功能分析

Type: OpenClaw Skill Name: buffer-social Version: 1.0.0 The OpenClaw Buffer skill is a well-structured Node.js CLI tool designed for legitimate interaction with the Buffer GraphQL API. All code, dependencies (axios, chalk, commander, dotenv, ora), and documentation (SKILL.md, README.md, prds/buffer-skill.md) align with its stated purpose of social media post management. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, obfuscation, or prompt injection attempts against the OpenClaw agent. While the `validateImagePath` function checks for local file existence, the image upload feature is explicitly noted as 'BLOCKED' and is not implemented in the GraphQL API calls, thus preventing any potential file content exfiltration or arbitrary file reads.

能力评估

ℹ Purpose & Capability

Name, description, SKILL.md and source files consistently implement a Buffer CLI that talks to Buffer's GraphQL API. However the registry metadata claims 'Required env vars: none' and 'No install spec — instruction-only' while the SKILL.md and code clearly require BUFFER_API_KEY/.env and expect 'npm install'. That metadata omission is incoherent with the actual capability.

✓ Instruction Scope

SKILL.md and the code instruct the agent to read a local .env, validate BUFFER_API_KEY, call Buffer's API, and optionally read local image files (validated via existsSync). The instructions do not request unrelated files, other credentials, or unexpected external endpoints beyond Buffer and referenced developer docs.

ℹ Install Mechanism

There is no registry install spec but the package includes full Node.js source, package.json, and package-lock.json and SKILL.md tells users to run npm install. This is not inherently malicious, but the mismatch (no declared install but code present) is a sign to verify origin before running npm install from an untrusted skill.

⚠ Credentials

The runtime requires BUFFER_API_KEY (and optionally BUFFER_API_URL) per SKILL.md and lib/config.js, but the registry metadata lists no required env vars or primary credential. Requesting a single Buffer API key is proportionate for a Buffer integration, but the metadata omission increases risk (users might not realize a secret will be used).

✓ Persistence & Privilege

Skill is not always-enabled and does not request persistent system-wide privileges. It does not modify other skills or system configs; autonomy is allowed by default but does not combine with other privilege red flags here.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install buffer-social
安装完成后，直接呼叫该 Skill 的名称或使用 /buffer-social 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.0.0

Initial release: Buffer social media scheduling skill

元数据

Slug buffer-social

版本 1.0.0

许可证 —

累计安装 1

当前安装数 1

历史版本数 1

常见问题