Atlas / MCP servers / ndesv21 / SocialClaw

SocialClawBLOCK

Name: SocialClaw
Author: ndesv21

mcp/ndesv21/socialclaw

MCP server by ndesv21 · agentic ai · ai agent · ai agents · Audited 2026-10-07

Social media scheduling CLI and OpenClaw skill for AI agents posting to X, LinkedIn, Instagram, Facebook Pages, TikTok, Discord, Telegram, YouTube, Reddit, WordPress, and Pinterest.

Verdict

BLOCK

Grade

Trust score

69 /100

Exposed tools

—

Transport

stdio · streamable-http

License

MIT

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

SocialClaw

Social media scheduling CLI and OpenClaw skill for AI agents posting to X, LinkedIn, Instagram, Facebook Pages, TikTok, Discord, Telegram, YouTube, Reddit, WordPress, and Pinterest.

Official Website: getsocialclaw.com · Dashboard · npm · Skill Bundle

[getsocialclaw.com](https://getsocialclaw.com) is the official SocialClaw website — the hosted dashboard, API, and account sign-up all live there.

This repo is the public home for:

the socialclaw npm CLI
the OpenClaw and ClawHub skill bundle
the Claude Code plugin and /socialclaw command asset
public usage docs, provider notes, and schedule examples

Install

npm install -g socialclaw
socialclaw login
socialclaw accounts list --json

Install as an AI agent skill (Claude Code, Cursor, Cline, Codex, and more):

npx skills add ndesv21/socialclaw

What the CLI covers

workspace API key login and hosted dashboard bootstrap
browser OAuth connect plus manual Discord and Telegram connect
hosted asset upload and deletion
schedule validation, ca

Read from source at commit 4aeaa6095d24OBSERVED · 2026-10-07

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code (npm)

claude mcp add socialclaw --env SOCIALCLAW_API_KEY=${SOCIALCLAW_API_KEY} -- npx -y [email protected]

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	PASS
L2	Instruction surface (what it tells the agent)	FAIL
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: none-observed
Network: declared (3 observation(s))
Shell: none-observed
Dependencies: pinned
Secrets in source: none-found

Findings (8)

CRITICALPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427

skills/socialclaw/SKILL.md:329

**Telegram** (`telegram`) — bot-based posting. Connected manually with a bot token and `chat_id` or `@channelusername`, not via OAuth. One optional image or video per post.

Why it matters. an instruction to move sensitive data to an outside destination

Fix. remove; a skill never needs the user's secrets off the machine

HIGHPrompt injection · prompt.credential_read · CWE-94, CWE-1427

.agents/skills/socialclaw/SKILL.md:75

- open the API key section