Bundle

so-me.studio is a multi-platform social-media scheduler. Schedule posts, manage drafts, reply to inbox messages and post comments, generate AI captions/image...

This skill appears to be a CLI helper for the legitimate so-me.studio service and only requests the service API key, but proceed cautiously: - Confirm identity: verify the npm package @so-me/cli and the publisher before installing (check the package page, author, and GitHub repo referenced by the package). The registry metadata/title mismatch ('Bundle' vs 'so-me-studio') is odd—ask the publisher or check the package source if unsure. - Prefer browser OAuth over pasting keys: do not paste long API keys on the command line (they appear in shell history and may be visible to other processes). Use browser OAuth or set env vars in a secure session and avoid embedding keys in one-off CLI arguments. - Limit key scope & rotate: if possible create and use a restricted API key with only the needed scopes and rotate it if you later revoke access. - Audit webhook usage: the CLI can create webhook subscriptions with arbitrary URLs. If you allow the agent to create webhooks, make sure you control the target URL or understand where data will be sent. - Least privilege for automation: when giving an agent the API key, consider using a test workspace or an account with limited permissions first. If you want me to recommend specific checks (npm package verification steps, example least-privilege key scopes, or safer CLI usage patterns), I can provide them.

Type: OpenClaw Skill Name: so-me-studio Version: 0.1.2 The so-me-studio skill bundle is a comprehensive and well-documented integration for a social media management platform. It provides 143 tools for managing posts, analytics, and inbox communications across multiple platforms. The SKILL.md file includes proactive security instructions, explicitly telling the AI agent never to echo the SOMESTUDIO_API_KEY, which mitigates potential prompt-injection attacks aimed at credential theft. The bundle follows standard patterns for CLI-based agent skills, uses the official so-me.studio domain, and lacks any indicators of malicious intent, obfuscation, or unauthorized data exfiltration.