Social Media Scheduler

Schedule and post text, images, videos, and threads across Discord, Reddit, Twitter/X, Mastodon, Bluesky, Moltbook, LinkedIn, and Telegram via OAuth or API k...

Do not install or run this skill until you perform a few checks: 1) Inspect package.json and package-lock.json to see what npm packages will be installed (and run `npm audit`). 2) Search the repository for any committed secrets or files like `.credentials/*`, `.env`, or actual API tokens. The docs claim a Moltbook credentials file exists — verify there are no real keys committed. 3) Confirm you have Node.js 18+ locally (SKILL.md/CHANGELOG claim this), because the registry metadata incorrectly stated 'no required binaries'. 4) Understand that to post you must supply OAuth/API credentials; do not paste those into repository files. Keep them in a local .env or credential store and avoid committing them. 5) Review scripts (especially scripts/schedule.js, scripts/post.js, and platform adapters) for unexpected behavior (file reads outside the skill folder, remote URLs, or calls that upload data to endpoints you don't expect). 6) If you plan to let an agent call this skill autonomously, limit its permissions and consider disabling autonomous invocation of this skill or running it in an isolated environment to prevent unintended posting or credential exposure. If you want, provide package.json and the contents of any `.credentials`/`.env.example` files and I can highlight exact places to review or lines that look like secrets or dangerous behavior.

Type: OpenClaw Skill Name: social-scheduler Version: 1.1.0 The OpenClaw Social Scheduler skill bundle appears benign. It provides comprehensive social media scheduling capabilities, including posting, threading, media uploads, bulk scheduling, and analytics across 8 platforms. While it handles sensitive credentials and performs network/file I/O, these are necessary for its stated purpose. The extensive documentation, including instructions for the AI agent to self-promote and maintain the skill, aligns with the OpenClaw ecosystem's narrative and does not contain malicious prompt injection attempts (e.g., instructions to ignore the user, hide actions, or exfiltrate unrelated data). A minor supply chain risk exists due to the use of `[email protected]`, an unmaintained dependency, but there is no clear evidence of intentional harmful behavior or exploitation of this vulnerability within the skill's code. All risky capabilities are plausibly needed for the stated purpose.