Security audit
Security checks across malware telemetry and agentic risk
This appears to be a real social media scheduler, but it stores and exposes powerful posting credentials in ways users should review before installing.
Install only if you are comfortable granting the skill authority to post publicly from your accounts. Use test or least-privilege accounts first, avoid command-line secrets, protect or disable storage/queue.json and the dashboard, review every queued post before starting the daemon, and do not let agents post sensitive or unapproved content automatically.
}
/**
* Get OAuth2 access token
* @param {object} config - OAuth credentials
* @returns {Promise<string>} - Access token
*//**
* Get OAuth2 access token
* @param {object} config - OAuth credentials
* @returns {Promise<string>} - Access token
*/
async function getAccessToken(config) {
// Return cached token if still valid66/66 vendors flagged this skill as clean.
Detected: suspicious.exposed_secret_literal