Metricool

Schedule and manage social media posts via Metricool API. Use when posting to multiple platforms (LinkedIn, X, Bluesky, Threads, Instagram), checking scheduled posts, or analyzing social metrics.

What to consider before installing: - The code and SKILL.md are consistent with a Metricool integration: it needs a Metricool API token (METRICOOL_USER_TOKEN) and user id (METRICOOL_USER_ID) and will call app.metricool.com endpoints. That behavior is expected for this skill. - The registry metadata did NOT declare these required environment variables or a primary credential. Confirm with the skill author or registry owner why metadata omits the credentials the scripts expect; this inconsistency can break automated checks or hide credential requirements. - The included scripts will try to read credentials from (in order) process.env, ~/.moltbot/moltbot.json, and a workspace .env file. If you keep other secrets in your project .env or in ~/.moltbot/moltbot.json, those files will be read by the scripts (the code only extracts Metricool vars, but reading those files increases exposure). Prefer placing the Metricool token in a dedicated, minimal-scope location. - The package does not download remote code at install time (lower install risk), but it does contain executable JS files. If you are not comfortable, inspect the scripts yourself (they are plain JS) or run them in a sandboxed environment before giving them your real Metricool token. - Operational advice: use a Metricool token with the least privileges possible, rotate the token if it has been exposed, and verify network calls (they go to https://app.metricool.com). If you need stronger assurance, request the author add the required env vars to the registry metadata and provide an author/source homepage or signed release.

Type: OpenClaw Skill Name: metricool Version: 1.0.0 The skill bundle is benign. All scripts (`best-time.js`, `get-brands.js`, `list-scheduled.js`, `schedule-post.js`) load Metricool API credentials (METRICOOL_USER_TOKEN, METRICOOL_USER_ID) from environment variables, `~/.moltbot/moltbot.json`, or a local `.env` file, which is a standard practice for agent skills. All network requests are directed exclusively to the legitimate Metricool API domain (`https://app.metricool.com`) for the stated purpose of social media management. There is no evidence of data exfiltration to unauthorized endpoints, malicious execution, persistence mechanisms, obfuscation, or prompt injection attempts in `SKILL.md` or `README.md`.