Postavel

Connect to Postavel social media management platform via MCP (Model Context Protocol). Create, schedule, and manage social media posts across Facebook, Insta...

This skill appears coherent for connecting an AI assistant to Postavel via an MCP client. Before installing: (1) verify that https://postavel.com is the legitimate service you expect; (2) prefer running the included local script (~/.openclaw/workspace/skills/postavel/scripts/setup-mcp.sh or scripts/install-mcp.sh) after inspecting it instead of piping a remote URL directly to bash; (3) avoid running installation commands with sudo unless required and inspect any binary downloaded to /usr/local/bin; (4) be aware the flow opens your browser for OAuth and stores tokens in ~/.config/mcporter — you can revoke access later from Postavel settings; (5) if uncertain about mcporter, install it from its official upstream (Homebrew, npm, or GitHub releases) instead of a site-hosted installer.

Type: OpenClaw Skill Name: postavel Version: 1.5.0 The skill is classified as suspicious primarily due to the high-risk installation method described in `SKILL.md` and implemented in `scripts/install-mcp.sh`. The instruction `curl -fsSL https://postavel.com/install-mcp | bash` combined with the script's use of `sudo curl -L -o /usr/local/bin/mcporter` for binary download represents a significant supply chain vulnerability. If `postavel.com` were compromised, an attacker could replace the installation script with arbitrary malicious code, leading to remote code execution with elevated privileges on the user's system. While the current script content is benign and aims to install a legitimate tool, this method creates a critical attack surface. There are no direct prompt injection attempts with malicious intent in `SKILL.md`, nor any other clear indicators of intentional malware like data exfiltration or persistence.