Social Media Manager

Automate high-engagement 6-slide TikTok carousels using AI-generated consistent images and Postiz API for draft scheduling and notification.

This skill's instructions assume you have a Postiz API key and access to AI image-generation APIs and that curl (or equivalent) is available, but the registry metadata doesn't declare any required credentials or binaries — that's an inconsistency you should resolve before installing. Ask the author to: (1) explicitly declare required environment variables (Postiz API_KEY, any image-model keys) and list required binaries (e.g., curl); (2) explain exactly how and where you supply your Postiz key (will the skill store it? will it send it elsewhere?); (3) provide a homepage or source so you can audit or test in a sandbox. Until those are clarified, avoid granting a universal Postiz API key to an untrusted/unknown skill because it could publish across all your connected platforms. If you proceed, test with a Postiz account that has only test/draft permissions and do not share production credentials until you're satisfied with the behavior.

Type: OpenClaw Skill Name: social-media-manager Version: 1.1.0 The skill bundle instructs the AI agent to execute direct `curl` commands for network communication and file uploads to `api.postiz.com`, as detailed in `SKILL.md`. It also requires the agent to handle a sensitive `API_KEY` for authentication. While these actions are necessary for the stated purpose of a social media manager, the direct execution of shell commands and handling of credentials represent a significant attack surface, potentially leading to vulnerabilities like shell injection if the agent's inputs are not rigorously sanitized. There is no evidence of intentional malicious behavior, but the high-risk capabilities warrant a 'suspicious' classification.