Publora Instagram

Post or schedule content to Instagram using the Publora API. Use this skill when the user wants to publish images, reels, stories, or carousels to Instagram...

This skill appears to be what it says (a Publora-backed Instagram poster), but the SKILL.md clearly uses an API key (x-publora-key) while the skill metadata declares no required credential. Before installing: 1) Confirm where you'll store the Publora API key (ask the skill author to declare a required env var like PUBLORA_API_KEY or primaryEnv) and prefer a least-privilege key. 2) Verify the API base URL (https://api.publora.com) is the official endpoint you expect. 3) Understand that the skill will upload your local images/videos to S3 upload URLs returned by Publora — avoid sending sensitive media unless you trust the service. 4) Check whether the referenced 'publora' core skill is required (authentication/workspace webhook docs) and whether it's available/trusted. 5) If you need to allow autonomous invocation, be aware the agent could post on your behalf whenever invoked; consider restricting invocation or reviewing prompts that trigger it. If anything above is unclear, ask the skill author to update the metadata to declare the API key requirement and to document where tokens are stored/used.

Type: OpenClaw Skill Name: publora-instagram Version: 2.0.1 The skill bundle provides legitimate documentation and code examples for using the Publora API (api.publora.com) to manage Instagram posts. The instructions in SKILL.md are well-structured, align with the stated purpose, and do not contain any malicious commands, data exfiltration attempts, or prompt injection attacks.