The Agent Skills Directory

[SAFE]: The skill implements a secure credential management system. API keys are stored in a local configuration file at ~/.taisly/config.json using restricted file permissions (0o600 for the file and 0o700 for the directory), which ensures that only the current user can access the secrets.
[EXTERNAL_DOWNLOADS]: The Dockerfile includes an instruction to install the mcp-proxy package from the public npm registry. This is a standard dependency for proxying Model Context Protocol (MCP) requests.
[SAFE]: The skill instructions and code (src/mcp.js) enforce a safety check requiring a confirmed: true flag for the taisly_posts_create tool. This ensures the AI agent does not publish content to live social accounts without explicit user approval of the video, platforms, and caption.
[SAFE]: All network operations are directed to official vendor domains (app.taisly.com) for post validation and creation, representing legitimate and expected functionality for a social media integration tool.
[SAFE]: The skill processes user-provided captions and local video files. While this represents a data ingestion surface, the risk of indirect prompt injection is mitigated by the requirement for human-in-the-loop confirmation before sensitive API calls are executed.

taisly-social-media-posting