Postiz Extended

Schedule and manage social media posts via Postiz API (self-hosted or cloud). Direct API integration — no n8n dependency. Supports X/Twitter, LinkedIn, Bluesky with platform-specific character limits. Includes deduplication, scheduling, media upload, and thread creation. WHAT IT CAN DO: - Schedule posts to 28+ channels (X, LinkedIn, Bluesky, Reddit, Instagram, Facebook, Threads, YouTube, TikTok, Pinterest, Mastodon, and more) - Multi-platform posting in a single API call with platform-adapted content - X/Twitter thread creation for longer content - Media upload (file and URL) - Find next available posting slot per channel - List, query, update, and delete scheduled posts - Deduplication workflow (check existing before posting) - Platform-specific character limits and content tone guidance - Post state management (QUEUE, PUBLISHED, ERROR, DRAFT) - Helper script for quick posting with auto-validation USE WHEN: scheduling social media posts, creating multi-platform content, managing a posting calendar, uploading media for social posts, checking post status, creating X/Twitter threads, or automating social media workflows.

Do not install blindly. Specific recommendations: - Inspect the two included scripts (scripts/post.py and scripts/check_duplicates.py) before installing: search for network calls, subprocess.exec/OS calls, hard-coded secrets, or code that reads arbitrary files or posts data to remote hosts. - Treat the hard-coded credential in SKILL.md ([email protected] / Postiz2026!) as sensitive: assume it may be live. If you or your team used these credentials, rotate them immediately. If you copy examples, replace credentials with environment variables or prompt-based input. - Ask the publisher for a source repository or homepage; lack of origin reduces trust. If you cannot verify the source, run the skill in an isolated environment or sandbox. - Require the skill to declare required credentials (e.g., POSTIZ_EMAIL, POSTIZ_PASSWORD or an API token) instead of embedding them in docs, and prefer using an API token scoped to the account. - If you do not want automatic network calls, set disableModelInvocation:true for this skill or only use it via explicit user-invocation. - If you want further help, paste the contents of scripts/post.py and scripts/check_duplicates.py so they can be reviewed for risky patterns (shell execution, arbitrary remote hosts, secret exfiltration).

Type: OpenClaw Skill Name: Developer: Version: Description: OpenClaw Agent Skill Suspicious High-Entropy/Eval files: 2 The skill bundle is classified as suspicious primarily due to the presence of hardcoded credentials (email: `[email protected]`, password: `Postiz2026!`) in both the `SKILL.md` instructions and the Python scripts (`scripts/check_duplicates.py`, `scripts/post.py`). While these credentials appear to be for a specific, likely demo, instance (`https://postiz.home.mykuhlmann.com`), hardcoding credentials in a skill bundle is a significant security anti-pattern that exposes sensitive information. The skill otherwise aligns with its stated purpose of managing social media posts, with all network and file system access (e.g., `/tmp/postiz-cookies.txt` for session management) being directly related to interacting with the Postiz API. There is no evidence of prompt injection against the agent, data exfiltration to unrelated endpoints, or other malicious behaviors.