Cross-Post

Cross-post content to Twitter/X, Reddit, and LinkedIn from one prompt. Use when user wants to publish the same content to multiple social platforms, schedule...

Security Scan

The skill's code and instructions match its stated purpose (cross-posting to Twitter/X, Reddit, LinkedIn); it asks for and stores the expected API credentials and talks to official API endpoints, but there are a few small inconsistencies and privacy considerations to be aware of.

Purpose & Capability

The skill's name and description (cross-posting to Twitter/X, Reddit, LinkedIn) match the code and runtime instructions. The script interacts with the expected official API endpoints and asks for the expected credentials (Twitter bearer token & user id, Reddit client id/secret/username + REDDIT_PASSWORD env var, LinkedIn access token + person URN). One minor inconsistency: the registry metadata reports no required environment variables while the SKILL.md and the code rely on REDDIT_PASSWORD for Reddit OAuth.

Instruction Scope

SKILL.md instructs the agent/user to run the included Python script and to initialize a config at ~/.config/cross-post/config.json. The script's operations (reading config, optionally reading REDDIT_PASSWORD from env, calling official API endpoints, writing the config file) are all within the stated scope. The script will verify Twitter credentials by calling the API and may update the config with the resolved user id.

Install Mechanism

This is an instruction-only skill with a bundled Python script; there is no install spec or external download. Nothing is fetched from arbitrary URLs or installed automatically.

Credentials

The credentials the skill requires (API tokens/IDs for Twitter/Reddit/LinkedIn) are appropriate for cross-posting. The code expects REDDIT_PASSWORD to be provided via the REDDIT_PASSWORD environment variable (documented in SKILL.md) even though registry metadata lists no required env vars — this mismatch is notable. The script persists tokens and IDs into a JSON config file in the user's home directory (config is chmod 600), which is convenient but means secrets are stored on disk in plaintext; the SKILL.md warns not to commit the file.

Persistence & Privilege

The skill does not request system-wide privileges or 'always' installation. It creates and writes its own config at ~/.config/cross-post/config.json and sets restrictive permissions (600), which is expected behavior for storing service credentials.

Assessment

This skill appears to do what it says: it needs API credentials for the three social platforms and will store those credentials in ~/.config/cross-post/config.json (file mode 600). Before installing or running: 1) Confirm you are comfortable providing the listed tokens/credentials; provide REDDIT_PASSWORD via the REDDIT_PASSWORD env var rather than typing it into files. 2) Review and, if you prefer, create the config file yourself instead of using interactive setup so you control what is written. 3) Consider running the script in a limited environment (non-root user) and inspect the rest of the (truncated) script if you can — part of the main function was truncated in the review bundle so ensure there are no unexpected network calls in the remainder. 4) Keep backups and do not commit the config file to version control. If you want higher assurance, verify the script's network calls and OAuth endpoints on a test account before using with your primary accounts.

Post content to Twitter/X, Reddit, and LinkedIn via official APIs.

Setup

First time use:

python3 scripts/cross_post.py init-config

Config stored at ~/.config/cross-post/config.json.

Usage

# Post to all platforms
python3 scripts/cross_post.py post "Your content here"

# Post to specific platform
python3 scripts/cross_post.py post "Content" -p twitter

# Post as Twitter thread
python3 scripts/cross_post.py post "Long content..." -p twitter --thread

# Post to Reddit with title
python3 scripts/cross_post.py post "Body text" -p reddit -t "Title" -s python

# Read from file
python3 scripts/cross_post.py post -f draft.txt

# Preview formatting
python3 scripts/cross_post.py preview "Content" -p twitter
python3 scripts/cross_post.py preview "Content" -p reddit
python3 scripts/cross_post.py preview "Content" -p linkedin

Platform Requirements

Twitter/X

• Bearer Token (API v2)
• User ID
• Setup: developer.twitter.com

Reddit

• Client ID, Client Secret, Username
• Password via REDDIT_PASSWORD env var
• Setup: reddit.com/prefs/apps

LinkedIn

• Access Token
• Person URN
• Setup: developers.linkedin.com

Tips

• Use --thread for long Twitter content (auto-splits at 280 chars)
• Use --file to post from files
• Use preview before posting to check formatting
• Each platform has different length limits:
  • Twitter: 280 chars per tweet
  • Reddit: 100 char title, unlimited body
  • LinkedIn: 3000 chars

Security

Config file is chmod 600. Never commit config.json.