postiz

What the source does

• FilesystemNone observedNo reads or writes in the source
• NetworkDeclared5 observations
• ShellDeclared3 observations
• DependenciesNot pinnedSome versions float
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: no behavioural pass.

exec(`open "${url}"`);

exec(`start "" "${url}"`);

exec(`xdg-open "${url}"`);

console.log(`🔑 Token: ${creds.accessToken.substring(0, 8)}...`);

@types/pg, node-fetch, yargs, @types/node, @types/yargs, tsup, typescript

node-fetch, pg, @types/node, @types/pg, tsx, typescript

| `apiKeyEnv` | `POSTIZ_API_KEY` | Environment variable read at boot for the API key. |

# Add to ~/.bashrc or ~/.zshrc

3. Add to PATH: `export PATH=$PATH:/path/to/apps/cli/dist`

Audit 0.4.1 · source sha 9d48a52c87ab · 19 Oct 2026Report an issue or request a re-scan

• Publishergitroomhq GitHub organizationOwner of the repository this skill is read from
• Source foldergitroomhq/postiz-agentThe exact folder we audited
• LicenceNOASSERTIONAs the repository states it
• Commit pinned for this verdict9d48a52c87abA new audit runs when the source changes
• Repository statusNot archivedLast push 4 days ago
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: Postiz is a tool to schedule social media and chat posts to 28+ channels X, LinkedIn, LinkedIn Page, Reddit, Instagram, Facebook Page, Threads, YouTube, Google My Business, TikTok, Pinterest, Dribbble, Discord, Slack,…

---
name: postiz
description: Postiz is a tool to schedule social media and chat posts to 28+ channels X, LinkedIn, LinkedIn Page, Reddit, Instagram, Facebook Page, Threads, YouTube, Google My Business, TikTok, Pinterest, Dribbble, Discord, Slack, Kick, Twitch, Mastodon, Bluesky, Lemmy, Farcaster, Telegram, Nostr, VK, Medium, Dev.to, Hashnode, WordPress, ListMonk
homepage: https://docs.postiz.com/public-api/introduction
metadata: {"openclaw":{"emoji":"🌎","requires":{"bins":[],"env":["POSTIZ_API_URL"]}}}
---

## Install Postiz if it doesn't exist

```bash
npm install -g postiz
# or
pnpm install -g postiz
```

npm release: https://www.npmjs.com/package/postiz
postiz github: https://github.com/gitroomhq/postiz-app
postiz cli github: https://github.com/gitroomhq/postiz-app
official website: https://postiz.com
---


| Property | Value |
|----------|-------|
| **name** | postiz |
| **description** | Social media automation CLI and MCP server for scheduling posts across 28+ platforms including X, LinkedIn, LinkedIn Pages, Instagram, Facebook, Threads, YouTube, TikTok, Reddit, Pinterest, Bluesky, Mastodon, Google My Business, Discord, Slack, Telegram, Twitch, Kick, Lemmy, Farcaster, Nostr, VK, MeWe, Tumblr, Skool, Whop, Moltbook, Dribbble, Medium, Dev.to, Hashnode, WordPress, and ListMonk |
| **allowed-tools** | Bash(postiz:*) |

---

## ⚠️ Four Hard Rules (Read First)

**Rule 1 — Authenticate before anything.** All commands fail without valid credentials.

**Rule 2 — Every file passed to `-m` (or to `image`/media fields in JSON mode) MUST first go through `postiz upload`.** Raw filesystem paths (`image.jpg`, `video.mp4`) and external URLs (`https://example.com/...`) are **NOT** accepted by the publishing pipeline. TikTok, Instagram, YouTube, and most other providers reject anything that isn't a Postiz-verified URL. Always:

```bash
RESULT=$(postiz upload <file>)
URL=$(echo "$RESULT" | jq -r '.path')
postiz posts:create ... -m "$URL" ...
```

If you see `-m "something.jpg"` anywhere below, treat it as shorthand for "the `.path` you got back from `postiz upload something.jpg`" — never a raw local file.

A file that was already uploaded does not need uploading again: find it with `postiz media:list -s <name>` and reuse its `.path`.

**Rule 3 — When posting to TikTok, `content_posting_method` MUST be `"DIRECT_POST"`** unless the user has explicitly asked to finish the post inside the TikTok app. `"UPLOAD"` does not publish — it drops the media into the account's TikTok inbox to be completed manually within 24 hours, while the Postiz API still reports success. A user saying "upload this video to TikTok" means `"DIRECT_POST"`.

**Rule 4 — Fetch `postiz integrations:settings <id>` before scheduling and honor the returned `rules` and per-field `description`s.** They state which settings apply and when. A setting that doesn't apply (wrong posting method, wrong media type, etc.) is **silently discarded**, not rejected — the post still reports success, so this is your only chance to catch it.

---

## ⚠️ Authentication Required

**You MUST authenticate before running any Postiz CLI command.** All commands will fail without valid credentials.

Before doing anything else, check auth status:
```bash
postiz auth:status
```

If not authenticated, either:
1. **OAuth2:** `postiz auth:login`
2. **API Key:** `export POSTIZ_API_KEY=your_api_key`

**Do NOT proceed with any other commands until authentication is confirmed.**

---

## Core Workflow

The fundamental pattern for using Postiz CLI:

1. **Authenticate** - Verify or set up authentication (see above)
2. **Discover** - List integrations and get their settings
3. **Fetch** - Use integration tools to retrieve dynamic data (flairs, playlists, companies)
4. **Prepare** - Upload media files if needed (or reuse an existing `.path` from `media:list`)
5. **Post** - Create posts with content, media, and platform-specific settings
6. **Analyze** - Track performance with platform and post-level analytics
7. **Resolve** - If analytics returns `{"missing": true}`, run `posts:missing` to list provider content, then `posts:connect` to link it

```bash
# 1. Authenticate
postiz auth:status
# If not authenticated: postiz auth:login --client-id <id> --client-secret <secret>

# 2. Discover
postiz integrations:list
postiz integrations:settings <integration-id>

# 3. Fetch (if needed)
postiz integrations:trigger <integration-id> <method> -d '{"key":"value"}'

# 4. Prepare
postiz upload image.jpg
postiz media:list -s image   # or reuse an already-uploaded file

# 5. Post
postiz posts:create -c "Content" -m "image.jpg" -i "<integration-id>"

# 6. Analyze
postiz analytics:platform <integration-id> -d 30
postiz analytics:post <post-id> -d 7

# 7. Resolve (if analytics returns {"missing": true})
postiz posts:missing <post-id>
postiz posts:connect <post-id> --release-id "<content-id>"
```

---

## Essential Commands

### Authentication

**Option 1: OAuth2 (Recommended)**
```bash
# Login via device flow (opens browser, no client ID/secret needed)
postiz auth:login

# Check auth status (verifies credentials are still valid)
postiz auth:status

# Logout (remove stored credentials)
postiz auth:logout
```

Credentials are stored in `~/.postiz/credentials.json`. OAuth2 credentials take priority over API key.

**Option 2: API Key**
```bash
export POSTIZ_API_KEY=your_api_key_here
```

**Optional custom API URL:**
```bash
export POSTIZ_API_URL=https://custom-api-url.com
```

### Integration Discovery

```bash
# List all connected integrations
postiz integrations:list

# List integrations belonging to a specific group (customer)
postiz integrations:list --group <group-id>

# List all groups (customers) as {id, name}
postiz integrations:groups

# Get settings schema for specific integration
postiz integrations:settings <integration-id>

# Trigger integration tool to fetch dynamic data
postiz integrations:trigger <integration-id> <method-name>
postiz integrations:trigger <integration-id> <method-na

Excerpt, first 6,001 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

1. 2026-10-19
   ✕BLOCK D 69 / 100

   first audit · source 9d48a52c87ab

Questions about postiz

• github.com/gitroomhq/postiz-agent — the audited source at commit 9d48a52c87ab and every finding aboveObserved · 19 Oct 2026

Spotted something wrong? Report a correction · Methodology