Social Auto Poster

Automate posting content with images to LinkedIn, X/Twitter, Facebook, WordPress, and Substack via browser automation. Use when: (1) posting a new article or...

This skill appears internally consistent for automating posts, but before installing or using it you should: (1) verify the owner/source (no homepage provided) and prefer skills with a public repo/release; (2) inspect the image script (~/workspace/linkedin-assets/create-overlay-image.sh) — it will be executed and could run arbitrary shell commands; (3) prefer not to store credentials in world‑readable plaintext: restrict permissions on ~/.openclaw/.wp-[yoursite].env (chmod 600) or use a secrets store if available; (4) be aware the skill relies on long‑lived browser sessions — if the machine is multi‑user or exposed, an attacker with local access could reuse those sessions; (5) test on a throwaway account / VM first to confirm behavior; and (6) ask the publisher to: publish a source repo or homepage, add explicit steps to source the .env before API calls, and ideally support a safer credential mechanism. If you cannot inspect the image script and do not trust keeping browser sessions persistent, do not enable this skill.

Type: OpenClaw Skill Name: social-auto-poster Version: 1.1.0 The skill automates social media posting via browser automation and WordPress API calls, requiring high-privilege access such as reading local credentials from `~/.openclaw/` and executing a local shell script (`create-overlay-image.sh`). While the logic in `SKILL.md` and `references/platform-quirks.md` is consistent with its stated marketing purpose, the pattern of passing potentially unsanitized user content (quotes) directly to a shell script poses a shell injection risk. The skill's reliance on persistent browser sessions and stored WordPress Application Passwords makes it a high-risk component if the agent's environment is compromised.