Social Poster

Post to social media via VibePost API. Use when posting to Twitter/X, sharing updates, or publishing social content.

Security Scan

The skill does what it claims (posts to a social API) but embeds a hardcoded API key and points to an undeclared third-party Replit endpoint — a mismatch that could let others post via that service and is not properly disclosed.

Purpose & Capability

The skill's stated purpose (posting to social media via VibePost) matches the included script which performs an HTTP POST to an API. However the endpoint is a personal Replit URL and the script contains a hardcoded API key instead of declaring a credential the user provides — this is unexpected and reduces transparency.

Instruction Scope

SKILL.md and the script are focused on posting text to the VibePost endpoint and do not reference unrelated files, system config, or additional environment variables. The script will send whatever text the agent supplies to an external service, which is consistent with the skill's purpose but is a privacy risk if sensitive content is posted.

Install Mechanism

There is no install spec (instruction-only plus a small script). Nothing is downloaded or written by an install step, which is low-risk in terms of installation mechanics.

Credentials

The skill requests no environment variables or credentials in metadata, yet the script contains a long, hardcoded API key ('quack_...') and uses it to authenticate to a third-party Replit-hosted API. This undeclared embedded credential is a mismatch with the metadata and is risky: it grants posting ability without the user supplying their own key and could be abused.

Persistence & Privilege

The skill is not always-enabled and does not request elevated or persistent platform privileges. It does not modify other skills or system-wide settings.

What to consider before installing

This skill will post whatever text it is given to an external Replit-hosted API and includes a hardcoded API key inside the script. Before installing, consider the following: (1) The embedded API key is not declared and could allow anyone using the skill to post via that service — ask the author to remove the hardcoded key and require a user-owned key passed via an environment variable. (2) Verify the endpoint and operator (https://vibepost-jpaulgrayson.replit.app) — it's a personal/third-party host, not an official, known provider. (3) Do not send sensitive content through this skill until you trust the endpoint. (4) Prefer a version that documents required credentials in metadata and uses process environment variables (not embedded secrets). If you cannot confirm the maintainer or remove the embedded key, avoid installing or run it only with a disposable/test account.

Post to social media platforms via the VibePost API.

Setup

API key is configured in the script. Uses x-quack-api-key header for authentication.

Scripts

Post Content

node skills/social-poster/scripts/post.mjs --text "Hello world" [--platform twitter]

API Reference

• Endpoint: POST https://vibepost-jpaulgrayson.replit.app/api/quack/post
• Auth: x-quack-api-key header
• Body: { "text": "your message", "platform": "twitter" }
• Field is text not content

Tips

• Keep posts under 280 chars for Twitter
• Add hashtags for discoverability
• Be authentic — write as your agent persona