Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add fajrisilmi12-cyber/hermes-socmed-function --skill social-media-schedulinggit clone --depth 1 https://github.com/fajrisilmi12-cyber/hermes-socmed-functionWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/fajrisilmi12-cyber/hermes-socmed-function/social-media-scheduling)<a href="https://agentmods.dev/skills/fajrisilmi12-cyber/hermes-socmed-function/social-media-scheduling"><img src="https://agentmods.dev/badge/skills/fajrisilmi12-cyber/hermes-socmed-function/social-media-scheduling/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/fajrisilmi12-cyber/hermes-socmed-function/social-media-scheduling"><img src="https://agentmods.dev/badge/skills/fajrisilmi12-cyber/hermes-socmed-function/social-media-scheduling.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 9 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00018 | $0.01245 |
| Opus 5 | $0.00009 | $0.00622 |
| Sonnet 5 | $0.00004 | $0.00249 |
| Haiku 4.5 | $0.00002 | $0.00125 |
Grade A, and why
social-media-scheduling scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 85 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Social Media Scheduling via Postnify
Fajri schedules Instagram posts through chat ("upload ini jam 6 sore, caption X").
The tool is Postnify CLI (/usr/bin/postnify, OAuth2 already valid in ~/.postnify/credentials.json).
Load this skill before running any postnify command — it carries the account IDs,
the gotchas that actually bit us, and a ready verification script.
Workflow
- Identify target time — Fajri speaks WIB (UTC+7): "jam 6 sore" = 18:00 WIB = 11:00Z.
Confirm with
date -uif the current UTC time is near or past the requested slot. - Check auth + integration (skip only if used earlier same session):
postnify auth:statusthenpostnify integrations:list. - Upload media FIRST —
postnify upload <file>→ use returned.pathURL in-m. Never pass local paths or foreign URLs to-m. - Create post —
-sdate is REQUIRED and must be ISO8601 Zulu:postnify posts:create -c "<caption>" -m "<uploaded-url>" -s "<YYYY-MM-DDTHH:MM:SSZ>" \ --settings '{"post_type":"post"}' -i "$IG_ID" - Verify — run
scripts/verify_ig_schedule.sh <post-id>(or read its inline logic): confirm state=QUEUE and publishDate matches the request; report both to the user.
Gotchas learned the hard way (do not rediscover)
post_typeis REQUIRED for instagram-standalone or posts:create returns 400 (settings.post_type should not be null). Always pass--settings '{"post_type":"post"}'(or"story"). This error is NOT mentioned as required inintegrations:settingsoutput. Stories: use"story"+ a space" "as caption when the user says "tanpa caption" (empty-c ""fails with "Either --content or --json is required").- Instagram rejects WebP uploads at PUBLISH time, not create time. The post shows
state=QUEUE and only fails later with ERROR. Convert to JPEG first:
ffmpeg -y -i in.webp out.jpg. After any ERROR, delete + recreate with converted media; do not just reschedule the broken post. - Deleting a queued post:
postnify posts:delete <id>works cleanly while state=QUEUE/ERROR. - Pin order: schedule earlier-requested posts earlier even if asked in reverse order, so the queue matches how Fajri thinks about them.
- Time math: Fajri speaks WIB = UTC+7 ("jam 8:40 malam" → 13:40Z same day). Confirm
with
date -uright before scheduling; he schedules near-current-time slots often. - Free tier is 15 posts/month. When volume matters or user complains about the cap, point IG/FB scheduling to Meta Business Suite (free, unlimited) instead of upgrading; keep Postnify for multi-platform pushes.
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 85 lines · 18 tokens per session scan A 96e7b3c2b26a
social-media-scheduling is a skill published in the GitHub repository fajrisilmi12-cyber/hermes-socmed-function (20 stars, last pushed 13d ago), licensed MIT. It adds 18 tokens to every session and 1,245 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
humanize-automation
Human-like mouse, keyboard and scroll behavior for behavioral bot bypass.
research-intelligence
Use when a Hermes agent must perform public-source research, source scouting, evidence grading, competitor/tool comparison, community-signal analysis, or decision-ready brief writing without private data or credentials.
hermes-diagnostic-review
Use when running a read-only diagnostic review of recent Hermes sessions to find recurring mistakes, failed tool calls, and repeated fixes, then propose suggestion-only improvements and reusable skills. Human-gated; never auto-applies.
holix-cron
Schedule recurring agent tasks via Holix built-in gateway cron (not crontab or custom scripts).
tag
A skill for turning image ideas, characters, scenes, and styles into Danbooru tags, which are standardized labels used in some AI image tools.
electric-blue-halftone-poster
A photo-editing style that turns one portrait or pet headshot into a square electric-blue poster with a tightly cropped black-and-white head, coloured stars, and a small barcode detail.