Postproxy

Call PostProxy API to create and manage social media posts

This skill appears to be a simple PostProxy API wrapper, but take these precautions: (1) The SKILL.md requires POSTPROXY_API_KEY but the registry metadata doesn't declare it — confirm with the author before supplying credentials. (2) The examples show uploading local files (media[]=@/path/to/file); avoid giving the skill broad filesystem access or uploading sensitive files. (3) There is no source or homepage listed — try to verify the publisher and the service (https://app.postproxy.dev) and prefer using a scoped/limited API key or a test account. (4) If you install, start in a sandboxed environment and monitor network calls; revoke the key if behavior is unexpected.

Type: OpenClaw Skill Name: Developer: Version: Description: OpenClaw Agent Skill The skill is classified as suspicious due to the combination of broad permissions and risky capabilities. It explicitly allows the AI agent to execute arbitrary Bash commands (`allowed-tools: Bash` in SKILL.md) and demonstrates the ability to upload any local file (`-F "media[]=@/path/to/image.jpg"` in SKILL.md) to the external API at `https://api.postproxy.dev`. While these capabilities are presented as part of the skill's stated purpose (managing social media posts), they represent significant attack surface for potential abuse, such as unauthorized file exfiltration or arbitrary command execution, if the agent were to be prompted maliciously.