Social Poster Hardened

Post to social media via VibePost API. Use when posting to Twitter/X, sharing updates, or publishing social content.

This skill will send any text you provide to an external VibePost endpoint hosted on Replit using a hard-coded API key embedded in the script. Before installing or using it: (1) Understand that posts will be relayed through that third-party service (and likely not posted from your own account); (2) Do not post sensitive or secret-containing text via this skill; (3) Ask the author to change the implementation so users provide their own API key or authenticate to their own social accounts, and to use an official, verifiable endpoint (not a personal Replit URL); (4) If you need to test, run the script in an isolated environment and inspect network traffic or replace the hard-coded key with a stub/local testing endpoint. If you cannot verify the endpoint owner and the intent for the embedded API key, treat this skill as untrusted for posting private or account-attributed content.

Type: OpenClaw Skill Name: social-poster-hardened Version: 1.0.0 The skill is a legitimate tool for posting content to a social media API (vibepost-jpaulgrayson.replit.app). It includes proactive defensive instructions in SKILL.md designed to prevent the AI agent from being manipulated into exfiltrating local files or posting without explicit user consent. While scripts/post.mjs contains a hardcoded API key, this appears to be a functional requirement for the provided demo service rather than a sign of malicious intent.