Automated Tweet Scheduler

自動化Twitter排程發布工具 - 幫你schedule tweets、分析Engagement、管理content calendar。支持thread scheduling、media upload、analytics dashboard

Security Scan

The skill's description claims Twitter scheduling, media uploads, cloud storage, and analytics but the instructions declare no credentials or config — several required external services are implied but not requested, which is inconsistent and risky.

Purpose & Capability

The SKILL.md describes scheduling tweets, media upload, analytics, PostgreSQL, AWS S3, and Telegram/Discord bots (and explicitly names Twitter API v2). Any legitimate implementation would need Twitter API credentials, cloud credentials and database access. The registry entry declares no required env vars, credentials, or config paths — this mismatch suggests the skill is incomplete or asking for sensitive information outside its declared surface.

Instruction Scope

The runtime instructions are high-level and do not show concrete, limited steps for obtaining or using credentials. They imply network calls (Twitter API, S3, bot APIs) and storage of media/analytics, but give no guidance on where credentials come from, how tokens are obtained (OAuth vs. raw keys), or how user data is protected. The instructions are vague and grant broad discretion to the agent.

Install Mechanism

No install spec and no code files (instruction-only). That reduces direct disk-write/remote-download risk; however, the lack of code means the security surface is primarily in runtime prompts and credential handling, which are not described.

Credentials

The skill implies use of multiple external services (Twitter, AWS S3, PostgreSQL, Telegram/Discord) but declares no required environment variables or primary credential. Requesting multiple unrelated credentials would be concerning; the current absence of any declared credentials is incoherent with the described functionality and increases the risk that the agent will prompt for or mishandle secrets.

Persistence & Privilege

The skill is not always-included and does not request any system config paths or persistent privileges. Autonomous invocation is allowed (platform default), which is expected for a user-invocable skill.

What to consider before installing

This skill describes features that require API keys and cloud credentials (Twitter/X API keys or OAuth tokens, AWS credentials for S3, DB credentials) but the package declares none — that's an inconsistency. Before installing or using: (1) Verify the publisher and request source code or a trustworthy repo; (2) Never paste high-privilege credentials into chat. Prefer OAuth flows or ephemeral tokens; (3) If you must provide credentials, use least-privilege tokens (S3-limited bucket policy, DB user with limited rights, Twitter token scoped to posting only); (4) Ask how credentials are stored/transmitted (encrypted storage? external servers?); (5) Prefer running this in a sandbox or separate account and avoid giving global AWS keys; (6) If the skill will integrate with Telegram/Discord, confirm what content is forwarded externally and get a privacy policy. The inconsistencies here could be sloppy documentation or an attempt to extract credentials — proceed cautiously.

功能

1. Tweet排程

• Schedule單條tweet
• Schedule threads
• 設定最佳發布時間
• Queue system

2. Content Calendar

• 睇monthly view
• Edit/Delete scheduled
• Drag & drop reschedule

3. Thread Builder

• 視覺化整thread
• Preview before send
• Auto-thread break

4. Analytics

• Engagement metrics
• Best posting times
• Follower growth
• Top performing tweets

5. Media

• Image upload
• Video/GIF support
• Alt text

使用方式

User: schedule "Just launched my new AI agent! 🚀" tomorrow 9am
AI: ✅ Scheduled for tomorrow 9:00 AM

User: show calendar
AI: 📅 [Calendar view with scheduled tweets]

Tech Stack

• Twitter API v2
• Node.js/Python
• PostgreSQL
• Cloud storage (AWS S3)
• Telegram/Discord bot

報價

Plan	Price	Tweets/month
Free	$0	30
Pro	$19	300
Business	$49	Unlimited

---

呢個skill可以serve:

• Content creators
• Marketers
• Crypto influencers
• Businesses