socialclaw-9c53c0 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited socialclaw-9c53c0 (Agent Skill) and scored it 92/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
SocialClaw is a workspace-scoped social publishing service at https://getsocialclaw.com.
This skill is an instruction layer for the hosted SocialClaw service.
It does not contain the SocialClaw backend or the provider integrations themselves. It teaches an OpenClaw-compatible agent how to:
socialclaw CLI if it is already installedThis skill can work without the CLI. The CLI is only an optional client for the same hosted service.
Use this skill when the user wants to:
Do not use this skill for editing the SocialClaw codebase itself. This bundle is for operating a deployed SocialClaw workspace.
https://getsocialclaw.comAuthorization: Bearer <key>socialclaw CLI when installedSC_API_KEYhttps://getsocialclaw.comsocialclaw (or social) if already installedSocialClaw also has a separate npm CLI package named socialclaw.
Prefer it when it is already installed or the user wants command-line examples. The CLI is a client for the hosted SocialClaw service. It can:
socialclaw install --claudeThe CLI is optional. This skill does not require it to function.
If the user explicitly wants the CLI and it is not installed yet:
npm install -g socialclawIf the user does not have a workspace API key yet:
open https://getsocialclaw.com/dashboardThen tell them:
Set:
export SC_API_KEY="<workspace-key>"If the CLI is installed, log in with it:
socialclaw login --api-key <workspace-key>Otherwise validate the key over HTTP:
curl -sS \
-H "Authorization: Bearer $SC_API_KEY" \
"https://getsocialclaw.com/v1/keys/validate"If execution fails with plan_required, subscription_inactive, subscription_past_due, subscription_paused, or subscription_canceled, direct the user to:
https://getsocialclaw.com/pricinghttps://getsocialclaw.com/dashboardhttps://getsocialclaw.com/dashboard to sign in with Google and create one.TikTok photo/gallery posts are stricter than video posts. Before scheduling or applying a TikTok photo post:
picture_size_check_failed.settings.autoAddMusic: true when the user wants TikTok to choose recommended music. TikTok's Content Posting API does not expose selecting a specific sound.name/title unless the user explicitly wants one. For TikTok posts, put user-facing copy in description; otherwise dashboards or previews may show an unwanted title field.providerStatus: accepted means it is visible. Reconcile the post after a short delay:socialclaw posts reconcile --post-id <post-id> --jsonTreat providerStatus: published with reconciliationStatus: confirmed as the stronger success signal. If reconciliation returns picture_size_check_failed, regenerate resized/padded images, upload those corrected assets, and reschedule.
If the CLI is installed, prefer commands like these:
Store the workspace key:
socialclaw login --api-key <workspace-key>Start a connection flow:
socialclaw accounts connect --provider youtube --openStart a Pinterest OAuth connection:
socialclaw accounts connect --provider pinterest --openConnect Telegram manually with a bot token and chat target:
socialclaw accounts connect --provider telegram --bot-token <bot-token> --chat-id @yourchannel --jsonConnect Discord manually with a channel webhook URL:
socialclaw accounts connect --provider discord --webhook-url <discord-webhook-url> --jsonList connected accounts:
socialclaw accounts list --jsonUpload media:
socialclaw assets upload --file ./image.png --jsonValidate a schedule:
socialclaw validate -f schedule.json --jsonApply a schedule:
socialclaw apply -f schedule.json --jsonInstall the Claude Code command:
socialclaw install --claudeInspect a post:
socialclaw posts get --post-id <post-id> --jsonFor browser-based account linking:
socialclaw accounts connect --provider <provider> --opensocialclaw accounts status --connection-id <id> --jsonPOST /v1/connections/startGET /v1/connections/:connectionIdSupported providers:
xfacebookinstagram_businessinstagramlinkedinlinkedin_pagepinteresttiktokdiscordtelegramyoutuberedditwordpressTelegram and Discord are the exceptions to the browser-based OAuth flow.
Telegram is connected manually with:
chat_id or @channelusernameFor Telegram:
socialclaw accounts connect --provider telegram --bot-token <token> --chat-id <@channel|chat_id> --jsonPOST /v1/connections/start with {"provider":"telegram","botToken":"...","chatId":"..." }Discord is connected manually with:
For Discord:
socialclaw accounts connect --provider discord --webhook-url <discord-webhook-url> --jsonPOST /v1/connections/start with {"provider":"discord","webhookUrl":"..." }~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.