From daa22ec2ead0dbcc191d2944baf21725d1410747 Mon Sep 17 00:00:00 2001 From: Wen Date: Wed, 14 Oct 2026 14:37:06 -0300 Subject: [PATCH] docs(social-publisher): require user approval before socialclaw apply apply creates real posts, but the workflow went straight from validate to apply. Require showing every post and getting explicit approval first. Also note that the CLI only takes the API key as an argument, so the user should run login themselves instead of the agent. Signed-off-by: Wen (cherry picked from commit 93dce707f1f8f5bd86761b96d361b2bea359d777) --- skills/social-publisher/SKILL.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/skills/social-publisher/SKILL.md b/skills/social-publisher/SKILL.md index a00651738..b745b504c 100644 --- a/skills/social-publisher/SKILL.md +++ b/skills/social-publisher/SKILL.md @@ -32,6 +32,8 @@ npm install -g socialclaw@0.1.12 socialclaw login --api-key ``` +The CLI takes the key only as the `--api-key` argument and saves it to `~/.socialclaw/config.json`. While the command runs, other local users can see the argument in `ps`, and your shell may keep it in history. Run `socialclaw login` yourself, once, in your own terminal; do not have the agent expand `$SC_API_KEY` into the command line. + ## Core Workflow ### 1. List connected accounts @@ -83,6 +85,9 @@ socialclaw validate -f schedule.json --json ``` ### 5. Publish + +`apply` creates or schedules real posts on the user's accounts. Before running it, show the user every post in the validated `schedule.json` (provider, account, text, media, `scheduled_at`) and get explicit approval. If `schedule.json` changes after approval, ask again. Never run `apply` in the same step that generated the content. + ```bash socialclaw apply -f schedule.json --json # → { "run_id": "..." }