Security audit
Security checks across malware telemetry and agentic risk
This social scheduler appears purpose-built for posting and media uploads, but it handles real account credentials and public posting with under-scoped safeguards.
Install only if you are comfortable giving this skill authority to publish to real social accounts. Use test accounts first, avoid passing live secrets on the command line, keep credential and queue files outside version control with restricted permissions, and do not let untrusted prompts choose local file paths or remote media URLs.
const auth = Buffer.from(`${config.clientId}:${config.clientSecret}`).toString('base64');
const userAgent = config.userAgent || 'OpenClawBot/1.0';
const response = await fetch('https://www.reddit.com/api/v1/access_token', {
method: 'POST',
headers: {
'Authorization': `Basic ${auth}`,}
/**
* Get OAuth2 access token
* @param {object} config - OAuth credentials
* @returns {Promise<string>} - Access token
*//**
* Get OAuth2 access token
* @param {object} config - OAuth credentials
* @returns {Promise<string>} - Access token
*/
async function getAccessToken(config) {
// Return cached token if still valid66/66 vendors flagged this skill as clean.
Detected: suspicious.exposed_secret_literal