Typefully — 技能工具
v0.1.0[自动翻译] Create, schedule, and manage social media posts via Typefully. ALWAYS use this skill when asked to draft, schedule, post, or check tweets, posts, thre...
0· 735·2 当前·2 累计
by 安全扫描
OpenClaw
可疑
medium confidenceThe skill mostly does what it says (CLI wrapper for the Typefully API) but the package metadata omits the credential it clearly requires and the code exposes an undocumented endpoint override; these inconsistencies merit caution.
评估建议
This skill appears to be a legitimate Typefully CLI wrapper, but there are two red flags you should consider before installing or running it:
1) Metadata mismatch: The registry entry does not declare the TYPEFULLY_API_KEY even though the SKILL.md and included script require it. Ask the publisher (or the skill source) to update the metadata to declare TYPEFULLY_API_KEY as a required credential so automated checks and users can see this up front.
2) Endpoint override: The script honors TYPEFULLY...详细分析 ▾
⚠ 用途与能力
Name/description match the included code and SKILL.md: this is a Typefully CLI/skill for drafting, scheduling, and publishing social posts. However, the registry metadata lists no required environment variables or primary credential, while both SKILL.md and scripts/typefully.js require a TYPEFULLY_API_KEY (or config files). The metadata omission is an inconsistency that could mislead users or automated reviewers.
ℹ 指令范围
The SKILL.md stays on-topic and explicitly forbids searching the system for credentials. The runtime instructions and the CLI implementation only read: (1) TYPEFULLY_API_KEY env var, (2) ./ .typefully/config.json in the working directory, and (3) ~/.config/typefully/config.json — all reasonable for a CLI that stores API keys. The skill will call the Typefully API endpoint (default) to perform actions. There is no instruction to read unrelated system files or exfiltrate data, but the doc and code do reference other project files (e.g., CLAUDE.md / AGENTS.md) for “project context” which is reasonable but grants the agent discretion to look at repo-local files.
✓ 安装机制
There is no install spec (instruction-only installation), and the included script is a zero-dependency Node.js CLI that runs locally. This is a low-risk install model compared with downloading arbitrary archives. The skill will be executed via the provided script (allowed-tools).
⚠ 凭证需求
The skill requires an API key (TYPEFULLY_API_KEY) to function, but the registry metadata does not declare this required environment variable or a primary credential — a mismatch that reduces transparency. Additionally, the script supports overriding the API base via TYPEFULLY_API_BASE (useful for testing/self-hosting) but this override is not documented in the SKILL.md's 'Setup' section; an attacker or misconfiguration could point that to an arbitrary endpoint to intercept the API key. Overall, the environment access requested is reasonable for the stated purpose, but the lack of metadata declaration and the undocumented endpoint override create a proportionality concern.
✓ 持久化与权限
The skill does not request permanent presence (always is false) and does not modify other skills or system-wide settings. It reads and writes only its own expected config paths (project-local and user-global Typefully config) which is typical for a CLI tool.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv0.1.02026/2/13
Initial release of the Typefully social media skill for drafting, scheduling, and publishing posts via Typefully's API and CLI. - Enables drafting, scheduling, and managing posts for X/Twitter, LinkedIn, Threads, Bluesky, and Mastodon from one tool. - Provides clear setup, configuration, and troubleshooting guidance (including API key priority and error handling). - Describes workflow for handling multiple social media accounts (“social sets”) and setting defaults. - Documents common posting actions, multi-platform publishing, and tag usage for content organization. - Emphasizes best practices for error handling and user prompts.
● Pending
安装命令 点击复制
官方npx clawhub@latest install typefully-social-media
镜像加速npx clawhub@latest install typefully-social-media --registry https://cn.clawhub-mirror.com
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制