Social Media Suite

Automate social media posting to Instagram and YouTube. Schedule and publish images, videos, and content automatically. Social media automation tool for cont...

This package is documentation for a social-media automation tool, not an executable skill — there are no scripts included (no run.sh, instagram_poster.sh, or youtube_uploader.sh). Before using: 1) Ask the publisher for the actual implementation code or a trustworthy source (homepage/repo) and review that code yourself. 2) Never run scripts obtained from untrusted sources without auditing them; they could read or exfiltrate credentials or files. 3) If you create/store tokens as files, set strict filesystem permissions and prefer short-lived or scoped credentials where possible. 4) Prefer official OAuth flows and limit scopes (e.g., only content_publish). 5) If you want this skill to run in an agent, require the author to provide verifiable code and an install spec (or provide a vetted package) so you can audit what will run. If those things are not provided, treat the skill as incomplete and avoid running or sourcing third‑party run.sh scripts.

Type: OpenClaw Skill Name: social-media-suite Version: 1.0.1 The skill is classified as suspicious due to the high-risk nature of its operations and a significant vulnerability pattern presented in the documentation. The `SKILL.md` file provides an example `run.sh` script that demonstrates a shell injection vulnerability by passing unsanitized arguments (`"$@"`) directly to sub-scripts, which could lead to Remote Code Execution (RCE) if the actual implementation follows this pattern. Additionally, the skill requires handling sensitive credentials (long-lived access tokens) and processes external URLs (`--image-url`), posing potential risks like Server-Side Request Forgery (SSRF) or Local File Inclusion (LFI) if not properly validated by the underlying implementation.