Social Post

Post to social media platforms using the multi-provider social posting API. Use when user wants to post to Twitter, LinkedIn, Instagram, Facebook, TikTok, Th...

Security Scan

The skill's instructions match a social-posting purpose, but the SKILL.md requires API keys and runs local Python code / loads a .env while the registry metadata declares no credentials or binaries — this mismatch and the guidance to load local env/code are concerning.

Purpose & Capability

The declared purpose (multi-provider social posting) aligns with the instructions (using a SocialPostingClient, providers PostForMe/LATE, provider dashboard links). Requesting API keys for providers is reasonable for this functionality.

Instruction Scope

The SKILL.md instructs the agent to change directories, activate a virtualenv, insert a project path into sys.path, import and invoke local Python code, and load a .env file. Those steps cause the agent to read local files and environment variables and execute local code: this expands the skill's runtime scope beyond a simple API call and could expose unrelated secrets or run arbitrary local code if the referenced project contains unexpected modules.

Install Mechanism

There is no install spec and no code files shipped with the skill (instruction-only). That is lower risk than fetching and installing remote binaries.

Credentials

The SKILL.md requires POSTFORME_API_KEY and LATE_API_KEY in a .env, which is proportionate to the stated providers — but the registry metadata declares no required env vars or primary credential. This mismatch is important: the skill effectively needs credentials but doesn't advertise them. Additionally, load_dotenv('[your-project-root]/.../.env') will read whatever is in that file, potentially exposing unrelated secrets.

Persistence & Privilege

The skill is not marked always:true and does not request any persistent, system-wide privileges or modifications to other skills or agent configs. It does instruct using a local virtualenv but does not demand elevated system privileges.

What to consider before installing

This skill appears to do what it says (post to social providers) but has notable inconsistencies and local-side risks. Before installing or running it: 1) Confirm the skill metadata is updated to declare required env vars (POSTFORME_API_KEY, LATE_API_KEY). 2) Inspect the referenced local project (social-posting-api) source code — the SKILL.md asks the agent to import and execute it, so you must verify that code is safe and only calls provider APIs. 3) Put provider API keys in a dedicated .env used only for this project (avoid reusing a .env that contains other secrets). 4) Run the code in an isolated environment (dedicated VM or container) if possible. 5) Verify the provider domains (postforme.dev, getlate.dev) are legitimate before entering credentials. If you cannot inspect the local project or are uncomfortable with an agent loading a .env and executing local Python, do not enable this skill.

Social Posting Skill

Post to multiple social media platforms via the unified social posting API with automatic provider fallback.

---

Setup

Location: [your-project-root]/social-posting-api/

Environment:

cd [your-project-root]/social-posting-api
source venv/bin/activate

Required env vars in .env:

• POSTFORME_API_KEY - Primary provider (PostForMe)
• LATE_API_KEY - Fallback provider (LATE)

---

Quick Commands

Check Connected Accounts

from social_posting import SocialPostingClient
from dotenv import load_dotenv
load_dotenv()

client = SocialPostingClient()
print("Providers:", client.available_providers)
for acc in client.get_accounts():
    print(f"  {acc.platform}: {acc.username}")

Post Text Only

result = client.post(
    content="Your post content here",
    platforms=["twitter", "linkedin"]
)
print(f"Success: {result.success}, Provider: {result.provider}")

Post with Images

result = client.post(
    content="Check out these photos!",
    platforms=["instagram"],
    media_urls=[
        "https://example.com/image1.jpg",
        "https://example.com/image2.jpg"
    ]
)

Schedule a Post

from datetime import datetime

result = client.post(
    content="Scheduled post",
    platforms=["linkedin"],
    scheduled_for=datetime(2025, 1, 15, 9, 0)  # UTC
)

---

Supported Platforms

Platform	Text Only	With Media	Notes
Twitter/X	✅	✅	280 char limit
LinkedIn	✅	✅	Best for professional content
Instagram	❌	✅	Requires media
Facebook	✅	✅
TikTok	❌	✅	Video preferred
Threads	✅	✅
Bluesky	✅	✅
Pinterest	❌	✅	Requires media
YouTube	❌	✅	Video only

---

Complete Posting Script

#!/usr/bin/env python
"""Post to social media platforms."""

import sys
sys.path.insert(0, '[your-project-root]/social-posting-api')

from social_posting import SocialPostingClient
from dotenv import load_dotenv
load_dotenv('[your-project-root]/social-posting-api/.env')

def post_to_social(content: str, platforms: list, media_urls: list = None):
    """Post content to specified platforms."""
    client = SocialPostingClient()

    # Check which platforms are connected
    accounts = client.get_accounts()
    connected = [a.platform for a in accounts]

    # Filter to only connected platforms
    valid_platforms = [p for p in platforms if p in connected]

    if not valid_platforms:
        print(f"No connected accounts for: {platforms}")
        print(f"Connected: {connected}")
        return None

    # Post
    result = client.post(
        content=content,
        platforms=valid_platforms,
        media_urls=media_urls
    )

    if result.success:
        print(f"Posted via {result.provider}")
        print(f"   Post ID: {result.post_id}")
    else:
        print(f"Failed: {result.error}")

    return result

# Example usage
if __name__ == "__main__":
    post_to_social(
        content="Hello from the social posting API!",
        platforms=["instagram"],
        media_urls=["https://images.unsplash.com/photo-1506905925346-21bda4d32df4?w=1080"]
    )

---

Workflow for Posting

Step 1: Check Connected Accounts

Always check what's connected first:

cd [your-project-root]/social-posting-api
source venv/bin/activate && python -c "
from social_posting import SocialPostingClient
from dotenv import load_dotenv
load_dotenv()
client = SocialPostingClient()
for acc in client.get_accounts():
    print(f'{acc.platform}: {acc.username}')
"

Step 2: Prepare Content

• Twitter: Keep under 280 chars
• LinkedIn: Can be longer, professional tone
• Instagram: Needs at least 1 image
• 小红书: Use xiaohongshu-gtm skill for Chinese content

Step 3: Execute Post

source venv/bin/activate && python -c "
from social_posting import SocialPostingClient
from dotenv import load_dotenv
load_dotenv()

client = SocialPostingClient()
result = client.post(
    content='''Your content here''',
    platforms=['platform1', 'platform2'],
    media_urls=['https://example.com/image.jpg']  # Optional
)
print(f'Success: {result.success}')
print(f'Provider: {result.provider}')
print(f'Post ID: {result.post_id}')
"

---

Connecting New Accounts

To connect Twitter or other platforms:

Via PostForMe (Primary)

1. Go to https://postforme.dev/dashboard
2. Click "Connect Account"
3. Select platform and authorize

Via LATE (Fallback)

1. Go to https://getlate.dev/dashboard
2. Connect social accounts
3. API key in .env will auto-detect new accounts

---

Error Handling

Error	Cause	Solution
"No connected accounts"	Platform not linked	Connect via provider dashboard
"Instagram requires media"	Text-only post	Add at least 1 image URL
"HTTP 401"	Invalid API key	Check .env file
"All providers failed"	Both providers down	Try again later

---

Cross-Posting Strategy

For open source announcements:

# Post to developer platforms
result = client.post(
    content="Just open-sourced my multi-provider social posting API!\n\nFeatures:\n- Automatic fallback between providers\n- Supports 9+ platforms\n- Simple Python interface\n\nGitHub: https://github.com/[your-username]/social-posting-api",
    platforms=["twitter", "linkedin"]
)

For visual content:

# Instagram carousel
result = client.post(
    content="Behind the scenes of building [Your Product]",
    platforms=["instagram"],
    media_urls=[
        "https://example.com/image1.jpg",
        "https://example.com/image2.jpg",
        "https://example.com/image3.jpg"
    ]
)