← 返回 Skills 市场
Postproxy
作者
danbaranov
· GitHub ↗
· v0.1.0
1528
总下载
2
收藏
1
当前安装
1
版本数
在 OpenClaw 中安装
/install postproxy-skill
功能描述
Call PostProxy API to create and manage social media posts
安全使用建议
This skill appears to do what it says (call the PostProxy API), but the manifest omits the required POSTPROXY_API_KEY and the runtime instructions allow uploading local files to an external service. Before installing: (1) only set POSTPROXY_API_KEY in the agent environment if you trust the skill/source; (2) be aware that using the skill or allowing the model to invoke it may cause local files referenced by the agent to be uploaded to PostProxy; (3) if you want to prevent autonomous use, disable model invocation for the skill or avoid placing the API key in the agent environment; (4) prefer skills with matching declared requirements and a known/trusted source. If you need higher assurance, ask the publisher to update the manifest to declare POSTPROXY_API_KEY and to document file-upload behavior and invocation constraints.
功能分析
Type: OpenClaw Skill
Name: postproxy-skill
Version: 0.1.0
The skill is classified as suspicious due to the presence of high-risk capabilities, specifically `allowed-tools: Bash` and the ability to upload local files (`-F "media[]=@/path/to/image.jpg"`) to an external API (api.postproxy.dev) as demonstrated in SKILL.md. While these capabilities are plausibly needed for the stated purpose of managing social media posts with media, they grant broad shell access and file read/exfiltration potential to a third-party service, which constitutes a significant risk without clear malicious intent from the skill developer.
能力评估
Purpose & Capability
The SKILL.md describes calling the PostProxy API to manage social posts, which matches the skill name and description. However, the package metadata declared no required environment variables or primary credential while the instructions explicitly require POSTPROXY_API_KEY — a manifest/instructions mismatch.
Instruction Scope
Instructions are concrete curl examples covering listing, creating, scheduling, publishing, and deleting posts and include multipart file uploads from local paths (media[]=@/path/to/image.jpg). That is coherent with the purpose but has privacy implications: local files referenced by the agent could be uploaded to an external service. The SKILL.md also uses an $ARGUMENTS placeholder (open-ended) which could cause broader input being sent to the API if not constrained.
Install Mechanism
Instruction-only skill with no install spec or code files; nothing is written to disk by an installer. This is the lowest-risk install model.
Credentials
The skill requires a single service credential (POSTPROXY_API_KEY) in the instructions, which is proportionate to the stated purpose. But the registry metadata did not declare this required env var or a primary credential, creating an inconsistency. Also, having that API key available to the agent allows the skill to act on behalf of the user (including uploading content), so users should ensure the key is only set when they intend to allow those operations.
Persistence & Privilege
The skill does not set always:true (good) but also does not disable model invocation, meaning the model could call it autonomously and use any POSTPROXY_API_KEY present in the environment. That combination (model-invocable + access to an external API key) increases risk of unexpected API calls.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install postproxy-skill - 安装完成后，直接呼叫该 Skill 的名称或使用
/postproxy-skill触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v0.1.0
Initial release of postproxy-skill for managing social media posts via PostProxy API.
- Supports creating, listing, retrieving, and deleting posts across multiple platforms (Facebook, Instagram, TikTok, LinkedIn, YouTube, Twitter/X, Threads).
- Allows media uploads, scheduled posting, and draft creation/publishing.
- Supports platform-specific parameters (e.g., Instagram reels, YouTube privacy).
- Requires API key in environment variable POSTPROXY_API_KEY for authentication.
- Includes detailed usage examples for all major endpoints.
元数据
常见问题
Postproxy 是什么？
Call PostProxy API to create and manage social media posts. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 1528 次。
如何安装 Postproxy？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install postproxy-skill」即可一键安装，无需额外配置。
Postproxy 是免费的吗？
是的，Postproxy 完全免费（开源免费），可自由下载、安装和使用。
Postproxy 支持哪些平台？
Postproxy 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 Postproxy？
由 danbaranov（@danbaranov）开发并维护，当前版本 v0.1.0。
推荐 Skills