Openclaw Social Scheduler — 技能工具
v0.1.0[自动翻译] Schedule and post text, media, and threads to Discord, Reddit, Twitter/X, Mastodon, Bluesky, and Moltbook via API with immediate or scheduled publishi...
0· 2.4k·10 当前·10 累计
by 安全扫描
OpenClaw
可疑
medium confidenceThe skill's claimed purpose (a multi‑platform social scheduler) largely matches the code and docs, but there are inconsistencies around credential handling and installation that warrant caution before installing or enabling it.
评估建议
This skill appears to implement the described multi-platform scheduler, but review the following before installing:
- Credentials: The skill expects platform API tokens/keys (Twitter, Reddit, Mastodon, Bluesky, Moltbook, Discord webhooks). The registry metadata declares no required env vars/config paths, yet the docs and examples expect config JSON files or .credentials/*.json. Confirm there are no hardcoded or bundled credentials in the package (search for strings like 'moltbook_sk_' or other ...详细分析 ▾
ℹ 用途与能力
The skill implements a multi‑platform social scheduler (Discord, Reddit, Twitter/X, Mastodon, Bluesky, Moltbook) and includes platform modules and media upload code consistent with that purpose. However the registry metadata declares no required environment variables or config paths while the documentation and code expect user-provided API keys/config JSON files (and contain references to a local '.credentials/moltbook.json'), which is an inconsistency between declared requirements and actual usage.
ℹ 指令范围
SKILL.md instructs agents/users to run npm install and node scripts (post.js, schedule.js, upload-media.js, etc.) and provides examples that reference local config files and environment variables (e.g., process.env.WORKSPACE_ROOT). The instructions do not explicitly instruct wide system scanning or exfiltration, but they do rely on reading local credential files and env vars that are not declared in the registry metadata — the agent will need to read/store API credentials to function.
ℹ 安装机制
There is no registry install spec; the README and SKILL.md require running 'npm install' which pulls multiple npm packages (twitter-api-v2, @atproto/api, mastodon-api, node-fetch, form-data, etc.). Pulling from npm is expected for a Node CLI but is a moderate‑risk install vector compared with instruction‑only skills. The package-lock is present and shows legitimate, traceable npm packages rather than suspicious download URLs.
⚠ 凭证需求
Although the registry lists no required env vars or config paths, the code/docs require per‑platform credentials (API keys, OAuth tokens, webhook URLs) passed via JSON files, CLI args, or environment variables. More concerning: build notes claim '.credentials/moltbook.json' exists and 'we have' working credentials — this could mean the build expected or referenced local credential files. The skill does not justify asking for unrelated secrets, but the lack of declared config paths vs. the runtime need to read credential files is an incoherence that could lead to accidental credential exposure if default paths are used.
✓ 持久化与权限
The skill does not request always:true and will not be force‑included; it is user‑invocable and allows autonomous invocation (platform default). It does not appear to modify other skills or system configs. Running a scheduler daemon is normal for its purpose and does not by itself indicate excessive privilege.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv0.1.02026/2/4
Initial public release—free, open-source post scheduler for bots & agents: - Schedule posts across Discord, Twitter/X, Mastodon, Bluesky, Reddit, and Moltbook. - Media upload support for images/videos (Twitter/X, Mastodon, Bluesky). - New: Post and schedule full threads on Twitter, Mastodon, and Bluesky with automatic chaining. - Includes scheduling, immediate post, queue management, and post cancellation features. - Platform-specific setup guides and examples included in documentation.
● 可疑
安装命令
点击复制官方npx clawhub@latest install openclaw-social-scheduler
镜像加速npx clawhub@latest install openclaw-social-scheduler --registry https://cn.longxiaskill.com 镜像可用
本土化适配说明
Openclaw Social Scheduler — 技能工具 安装说明： 安装命令：npx clawhub@latest install openclaw-social-scheduler 支持国内镜像加速，使用 --registry https://cn.longxiaskill.com 参数可加速下载