Security audit
Security checks for vulnerabilities and agentic risk
The skill provides social publishing with clear approval steps and disclosure of public uploads, scheduling, and deletion limits.
Review the accounts authorized through OAuth and confirm every publishing destination. Uploaded disk files become publicly accessible before posting, and declining publication does not remove them. Some networks require manual deletion, and retries consume quota.
The manifest describes posting and managing content on the user's X account. This section instead instructs the agent to select multiple channel IDs to publish simultaneously to Instagram, TikTok, LinkedIn, Facebook Pages, YouTube Shorts, and Bluesky as well, expanding the publication destinations beyond the stated scope.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **Unschedule:** `cancel_post`. Use this, not `delete_post`, for a post that has not been published.
- **Delete a published post:** `delete_post`, only after the user confirms. Report per network what actually came down: Instagram, TikTok, Threads and YouTube posts stay live and only the user can remove them.
- **A delivery failed:** `retry_delivery` retries one network and spends quota again. It is refused for permanent failures such as a revoked connection — then the user must reconnect at https://1social.dev/app.
- **A delivery is `unknown`:** ask the user to look at the network. Only when they tell you whether the post is live, call `confirm_delivery` with their answer. Never guess, and never `retry_delivery` with `force` without asking — it may publish a second copy.
No suspicious patterns detected.