Typefully Skill

Create, schedule, list, edit, and delete drafts on Typefully. Supports single tweets, threads, and multi-platform posts (X, LinkedIn, Threads, Bluesky, Masto...

This skill appears to do what it says: it will make API calls to api.typefully.com using a Typefully API key you provide. Before installing: (1) Verify you trust the skill source (homepage repo) and inspect the included script (it is small and readable). (2) Provide a dedicated Typefully API key with the least privilege needed and keep it in your environment or in pass (the script will try pass if no env var). (3) Be aware the script will call out over the network to Typefully and will error if pass is not installed and no env var is set. (4) Note the registry metadata omitted the required TYPEFULLY_API_KEY even though SKILL.md and the script require it — double-check you supply the key. If you need stronger isolation, run the script in a constrained environment or container and rotate the API key if you stop using the skill.

Type: OpenClaw Skill Name: typefully-drafts Version: 1.0.0 The OpenClaw AgentSkills bundle for Typefully appears benign. The `SKILL.md` and `README.md` files clearly describe the skill's purpose and usage without any prompt injection attempts or malicious instructions. The `scripts/typefully.sh` script uses `curl` to interact with the Typefully API and `python3` for robust JSON parsing and escaping of user input, preventing injection vulnerabilities. API keys are securely retrieved from environment variables or the `pass` utility. All network communication is directed to the legitimate Typefully API endpoint (`https://api.typefully.com/v2`), with no evidence of data exfiltration, unauthorized command execution, persistence mechanisms, or obfuscation.