Postiz LitiaoSAFE

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

npm install -g postiz
# or
pnpm install -g postiz

export POSTIZ_API_KEY=your_api_key_here

export POSTIZ_API_URL=https://your-custom-api.com

postiz integrations:list

postiz integrations:settings 

postiz integrations:trigger  
postiz integrations:trigger   -d '{"key":"value"}'

# Get Reddit flairs
postiz integrations:trigger reddit-123 getFlairs -d '{"subreddit":"programming"}'

# Get YouTube playlists
postiz integrations:trigger youtube-456 getPlaylists

# Get LinkedIn companies
postiz integrations:trigger linkedin-789 getCompanies

postiz posts:create -c "Content" -s "2024-12-31T12:00:00Z" -i "integration-id"

postiz posts:create -c "Content" -s "2024-12-31T12:00:00Z" -t draft -i "integration-id"

postiz posts:create -c "Content" -m "img1.jpg,img2.jpg" -s "2024-12-31T12:00:00Z" -i "

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: postiz-litiao
description: Postiz is a tool to schedule social media and chat posts to 28+ channels X, LinkedIn, LinkedIn Page, Reddit, Instagram, Facebook Page, Threads, YouTube, Google My Business, TikTok, Pinterest, Dribbble, Discord, Slack, Kick, Twitch, Mastodon, Bluesky, Lemmy, Farcaster, Telegram, Nostr, VK, Medium, Dev.to, Hashnode, WordPress, ListMonk
homepage: https://docs.postiz.com/public-api/introduction
metadata: {"clawdbot":{"emoji":"🌎","requires":{"bins":[],"env":["POSTIZ_API_URL","POSTIZ_API_KEY"]}}}
---

## Install Postiz if it doesn't exist

```bash
npm install -g postiz
# or
pnpm install -g postiz
```

npm release: https://www.npmjs.com/package/postiz
postiz github: https://github.com/gitroomhq/postiz-app
postiz cli github: https://github.com/gitroomhq/postiz-app
official website: https://postiz.com
---


| Property | Value |
|----------|-------|
| **name** | postiz |
| **description** | Social media automation CLI for scheduling posts across 28+ platforms |
| **allowed-tools** | Bash(postiz:*) |

---

## Core Workflow

The fundamental pattern for using Postiz CLI:

1. **Discover** - List integrations and get their settings
2. **Fetch** - Use integration tools to retrieve dynamic data (flairs, playlists, companies)
3. **Prepare** - Upload media files if needed
4. **Post** - Create posts with content, media, and platform-specific settings
5. **Analyze** - Track performance with platform and post-level analytics
6. **Resolve** - If analytics returns `{"missing": true}`, run `posts:missing` to list provider content, then `posts:connect` to link it

```bash
# 1. Discover
postiz integrations:list
postiz integrations:settings <integration-id>

# 2. Fetch (if needed)
postiz integrations:trigger <integration-id> <method> -d '{"key":"value"}'

# 3. Prepare
postiz upload image.jpg

# 4. Post
postiz posts:create -c "Content" -m "image.jpg" -i "<integration-id>"

# 5. Analyze
postiz analytics:platform <integration-id> -d 30
postiz analytics:post <post-id> -d 7

# 6. Resolve (if analytics returns {"missing": true})
postiz posts:missing <post-id>
postiz posts:connect <post-id> --release-id "<content-id>"
```

---

## Essential Commands

### Setup

```bash
# Required environment variable
export POSTIZ_API_KEY=your_api_key_here

# Optional custom API URL
export POSTIZ_API_URL=https://custom-api-url.com
```

### Integration Discovery

```bash
# List all connected integrations
postiz integrations:list

# Get settings schema for specific integration
postiz integrations:settings <integration-id>

# Trigger integration tool to fetch dynamic data
postiz integrations:trigger <integration-id> <method-name>
postiz integrations:trigger <integration-id> <method-name> -d '{"param":"value"}'
```

### Creating Posts

```bash
# Simple post (date is REQUIRED)
postiz posts:create -c "Content" -s "2024-12-31T12:00:00Z" -i "integration-id"

# Draft post
postiz posts:create -c "Content" -s "2024-12-31T12:00:00Z" -t draft -i "integration-id"

# Post with media
postiz posts:create -c "Content" -m "img1.jpg,img2.jpg" -s "2024-12-31T12:00:00Z" -i "integration-id"

# Post with comments (each with own media)
postiz posts:create \
  -c "Main post" -m "main.jpg" \
  -c "First comment" -m "comment1.jpg" \
  -c "Second comment" -m "comment2.jpg,comment3.jpg" \
  -s "2024-12-31T12:00:00Z" \
  -i "integration-id"

# Multi-platform post
postiz posts:create -c "Content" -s "2024-12-31T12:00:00Z" -i "twitter-id,linkedin-id,facebook-id"

# Platform-specific settings
postiz posts:create \
  -c "Content" \
  -s "2024-12-31T12:00:00Z" \
  --settings '{"subreddit":[{"value":{"subreddit":"programming","title":"My Post","type":"text"}}]}' \
  -i "reddit-id"

# Complex post from JSON file
postiz posts:create --json post.json
```

### Managing Posts

```bash
# List posts (defaults to last 30 days to next 30 days)
postiz posts:list

# List posts in date range
postiz posts:list --startDate "2024-01-01T00:00:00Z" --endDate "2024-12-31T23:59:59Z"

# Delete post
postiz posts:delete <post-id>
```

### Analytics

```bash
# Get platform analytics (default: last 7 days)
postiz analytics:platform <integration-id>

# Get platform analytics for last 30 days
postiz analytics:platform <integration-id> -d 30

# Get post analytics (default: last 7 days)
postiz analytics:post <post-id>

# Get post analytics for last 30 days
postiz analytics:post <post-id> -d 30
```

Returns an array of metrics (e.g. Followers, Impressions, Likes, Comments) with daily data points and percentage change over the period.

**⚠️ IMPORTANT: Missing Release ID Handling**

If `analytics:post` returns `{"missing": true}` instead of an analytics array, the post was published but the platform didn't return a usable post ID. You **must** resolve this before analytics will work:

```bash
# 1. analytics:post returns {"missing": true}
postiz analytics:post <post-id>

# 2. Get available content from the provider
postiz posts:missing <post-id>
# Returns: [{"id": "7321456789012345678", "url": "https://...cover.jpg"}, ...]

# 3. Connect the correct content to the post
postiz posts:connect <post-id> --release-id "7321456789012345678"

# 4. Now analytics will work
postiz analytics:post <post-id>
```

### Connecting Missing Posts

Some platforms (e.g. TikTok) don't return a post ID immediately after publishing. When this happens, the post's `releaseId` is set to `"missing"` and analytics are unavailable until resolved.

```bash
# List recent content from the provider for a post with missing release ID
postiz posts:missing <post-id>

# Connect a post to its published content
postiz posts:connect <post-id> --release-id "<content-id>"
```

Returns an empty array if the provider doesn't support this feature or if the post doesn't have a missing release ID.

### Media Upload

**⚠️ IMPORTANT:** Always upload files to Postiz before using them in posts. Many platforms (TikTok, Instagram, YouTube) **require verified URLs** and will reject external links.

```bash
# Upload file and 

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

What the source does

Filesystem

none-observed

Network

none-observed

Shell

none-observed

Dependencies

pinned

Secrets in source

none-found

Findings (3)

<key>k5Ey9KFlkqpj+SDkUw+5ED9lTA3En/qUi0zdrydUCH3kMWTE3Eh65NXnFCaxlY2omY2JHnlEoK7Li7oOEvM7eG5VPdcO/sFlMfoCRdnLYdepJ+uLzYwOWR8W4yQVve/clxVFTVRL4DFleKInGdpAxIbHZT2yi4ADAMENls1N1XSLojRuqXePXDeAT/4Mv4TTx0s

# Add to ~/.bashrc or ~/.zshrc

3. Add to PATH: `export PATH=$PATH:/path/to/apps/cli/dist`

Gates applied: no_behavioural_pass.