{"id":"ab617cfe-f580-4851-99a8-9ed798846f03","entityType":"agent","slug":"clawhub-sammydigits-mallary","name":"Mallary Openclaw Skill","canonicalUrl":"https://www.xpersona.co/agent/clawhub-sammydigits-mallary","canonicalPath":"/agent/clawhub-sammydigits-mallary","generatedAt":"2026-10-09T19:20:10.969Z","source":"CLAWHUB","claimStatus":"UNCLAIMED","verificationTier":"NONE","summary":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"medium","updatedAt":"2026-10-09T17:41:20.439Z","emptyReason":null},"description":"Use this skill only when the user explicitly asks to inspect, set up, or act through Mallary, the Mallary CLI, the Mallary API, Mallary MCP, or an existing Mallary workflow. This guide includes read-only discovery and one-step OAuth setup with full Mallary access. A clear request to publish, schedule, upload media for a post, or send a reply authorizes that action without a redundant confirmation; clarify only material details that are missing. Executable write syntax is intentionally omitted.","descriptionLabel":"Source description","evidenceSummary":"Capability contract not published. No trust telemetry is available yet. 2.2K downloads reported by the source. Last updated 10/9/2026.","installCommand":"clawhub skill install s1772rrgd00r595atcvfwnk6qd84rkdg:mallary","sourceUrl":"https://clawhub.ai/sammydigits/mallary","homepage":"https://clawhub.ai/sammydigits/skills/mallary","primaryLinks":[{"label":"View on ClawHub","url":"https://clawhub.ai/sammydigits/mallary","kind":"source"},{"label":"Homepage","url":"https://clawhub.ai/sammydigits/skills/mallary","kind":"homepage"}],"safetyScore":84,"overallRank":62,"popularityScore":40,"trustScore":null,"claimedByName":null,"isOwner":false,"seoDescription":"Mallary Openclaw Skill technical dossier on Xpersona with agent coverage, OPENCLEW support, and live trust metadata."},"coverage":{"evidence":{"source":"public-profile","verified":false,"confidence":"medium","updatedAt":"2026-10-09T17:41:20.439Z","emptyReason":null},"protocols":[{"protocol":"OPENCLEW","label":"OpenClaw","status":"self-declared","notes":"Declared in the public agent profile."}],"capabilities":[],"verifiedCount":0,"selfDeclaredCount":1,"capabilityMatrix":{"rows":[{"key":"OPENCLEW","type":"protocol","support":"unknown","confidenceSource":"profile","notes":"Listed on profile"}],"flattenedTokens":"protocol:OPENCLEW|unknown|profile"}},"adoption":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"medium","updatedAt":"2026-10-09T17:41:20.439Z","emptyReason":null},"stars":null,"forks":null,"downloads":2193,"packageName":null,"latestVersion":"1.1.6","tractionLabel":"2.2K downloads"},"release":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"medium","updatedAt":"2026-10-09T17:41:20.439Z","emptyReason":null},"lastUpdatedAt":"2026-10-09T17:41:20.439Z","lastCrawledAt":"2026-10-09T17:41:20.439Z","lastIndexedAt":null,"nextCrawlAt":"2026-10-10T17:41:20.439Z","lastVerifiedAt":null,"highlights":[{"version":"1.1.6","createdAt":"2026-10-09T13:17:31.714Z","changelog":"Add support for drafts","fileCount":12,"zipByteSize":29448},{"version":"1.1.5","createdAt":"2026-09-29T12:24:02.957Z","changelog":"Add support for editing scheduled posts","fileCount":12,"zipByteSize":28427},{"version":"1.1.4","createdAt":"2026-09-04T14:16:31.009Z","changelog":"add support for youtube platlists and improve youtube shorts thumbnail messaging","fileCount":12,"zipByteSize":28821},{"version":"1.1.3","createdAt":"2026-09-01T20:23:23.145Z","changelog":"Improve post type discoverability","fileCount":12,"zipByteSize":28588},{"version":"1.1.2","createdAt":"2026-08-23T01:08:23.267Z","changelog":"Add support for Bluesky","fileCount":12,"zipByteSize":28100},{"version":"1.1.1","createdAt":"2026-08-14T16:29:30.852Z","changelog":"Add support for getting follower and subscriber counts","fileCount":12,"zipByteSize":27814},{"version":"1.1.0","createdAt":"2026-08-10T19:09:20.349Z","changelog":"Improve OAuth support","fileCount":12,"zipByteSize":27845},{"version":"1.0.9","createdAt":"2026-08-10T15:59:40.760Z","changelog":"Add OAuth support","fileCount":12,"zipByteSize":27558}]},"execution":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"low","updatedAt":null,"emptyReason":"No published capability contract is available yet."},"installCommand":"clawhub skill install s1772rrgd00r595atcvfwnk6qd84rkdg:mallary","setupComplexity":"low","setupSteps":["Install using `clawhub skill install s1772rrgd00r595atcvfwnk6qd84rkdg:mallary` in an isolated environment before connecting it to live workloads.","No published capability contract is available yet, so validate auth and request/response behavior manually.","Review the upstream CLAWHUB listing at https://clawhub.ai/sammydigits/mallary before using production credentials."],"contract":{"contractStatus":"missing","authModes":[],"requires":[],"forbidden":[],"supportsMcp":false,"supportsA2a":false,"supportsStreaming":false,"inputSchemaRef":null,"outputSchemaRef":null,"dataRegion":null,"contractUpdatedAt":null,"sourceUpdatedAt":null,"freshnessSeconds":null},"invocationGuide":{"preferredApi":{"snapshotUrl":"https://www.xpersona.co/api/v1/agents/clawhub-sammydigits-mallary/snapshot","contractUrl":"https://www.xpersona.co/api/v1/agents/clawhub-sammydigits-mallary/contract","trustUrl":"https://www.xpersona.co/api/v1/agents/clawhub-sammydigits-mallary/trust"},"curlExamples":["curl -s \"https://www.xpersona.co/api/v1/agents/clawhub-sammydigits-mallary/snapshot\"","curl -s \"https://www.xpersona.co/api/v1/agents/clawhub-sammydigits-mallary/contract\"","curl -s \"https://www.xpersona.co/api/v1/agents/clawhub-sammydigits-mallary/trust\""],"jsonRequestTemplate":{"query":"summarize this repo","constraints":{"maxLatencyMs":2000,"protocolPreference":["OPENCLEW"]}},"jsonResponseTemplate":{"ok":true,"result":{"summary":"...","confidence":0.9},"meta":{"source":"CLAWHUB","generatedAt":"2026-10-09T19:20:10.965Z"}},"retryPolicy":{"maxAttempts":3,"backoffMs":[500,1500,3500],"retryableConditions":["HTTP_429","HTTP_503","NETWORK_TIMEOUT"]}},"endpoints":{"dossierUrl":"https://www.xpersona.co/api/v1/agents/clawhub-sammydigits-mallary/dossier","snapshotUrl":"https://www.xpersona.co/api/v1/agents/clawhub-sammydigits-mallary/snapshot","contractUrl":"https://www.xpersona.co/api/v1/agents/clawhub-sammydigits-mallary/contract","trustUrl":"https://www.xpersona.co/api/v1/agents/clawhub-sammydigits-mallary/trust"}},"reliability":{"evidence":{"source":"runtime-metrics","verified":false,"confidence":"low","updatedAt":null,"emptyReason":"No trust, reliability, or runtime telemetry is available."},"trust":{"status":"unavailable","handshakeStatus":"UNKNOWN","verificationFreshnessHours":null,"reputationScore":null,"p95LatencyMs":null,"successRate30d":null,"fallbackRate":null,"attempts30d":null,"trustUpdatedAt":null,"trustConfidence":"unknown","sourceUpdatedAt":null,"freshnessSeconds":null},"decisionGuardrails":{"doNotUseIf":["Contract metadata is missing or unavailable for deterministic execution."],"safeUseWhen":[],"riskFlags":["missing_or_unavailable_contract","trust_data_unavailable","schema_references_missing"],"operationalConfidence":"low"},"executionMetrics":{"observedLatencyMsP50":null,"observedLatencyMsP95":null,"estimatedCostUsd":null,"uptime30d":null,"rateLimitRpm":null,"rateLimitBurst":null,"lastVerifiedAt":null,"verificationSource":null},"runtimeMetrics":{"successRate":null,"avgLatencyMs":null,"avgCostUsd":null,"hallucinationRate":null,"retryRate":null,"disputeRate":null,"p50Latency":null,"p95Latency":null,"lastUpdated":null}},"benchmarks":{"evidence":{"source":"no-benchmark-data","verified":false,"confidence":"low","updatedAt":null,"emptyReason":"No benchmark suites or observed failure patterns are available."},"suites":[],"failurePatterns":[]},"artifacts":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"medium","updatedAt":"2026-10-09T17:41:20.439Z","emptyReason":null},"readme":"Skill: Mallary Openclaw Skill\n\nOwner: sammydigits\n\nSummary: Use this skill only when the user explicitly asks to inspect, set up, or act through Mallary, the Mallary CLI, the Mallary API, Mallary MCP, or an existing Mallary workflow. This guide includes read-only discovery and one-step OAuth setup with full Mallary access. A clear request to publish, schedule, upload media for a post, or send a reply authorizes that action without a redundant confirmation; clarify only material details that are missing. Executable write syntax is intentionally omitted.\n\nTags: latest:1.1.6\n\nVersion history:\n\nv1.1.6 | 2026-10-09T13:17:31.714Z | user\n\nAdd support for drafts\n\nv1.1.5 | 2026-09-29T12:24:02.957Z | user\n\nAdd support for editing scheduled posts\n\nv1.1.4 | 2026-09-04T14:16:31.009Z | user\n\nadd support for youtube platlists and improve youtube shorts thumbnail messaging\n\nv1.1.3 | 2026-09-01T20:23:23.145Z | user\n\nImprove post type discoverability\n\nv1.1.2 | 2026-08-23T01:08:23.267Z | user\n\nAdd support for Bluesky\n\nv1.1.1 | 2026-08-14T16:29:30.852Z | user\n\nAdd support for getting follower and subscriber counts\n\nv1.1.0 | 2026-08-10T19:09:20.349Z | user\n\nImprove OAuth support\n\nv1.0.9 | 2026-08-10T15:59:40.760Z | user\n\nAdd OAuth support\n\nv1.0.8 | 2026-07-31T12:33:59.553Z | user\n\nUpdate all copy to STE100 standard\n\nv1.0.7 | 2026-07-25T14:32:39.440Z | user\n\nReturn platform url and id in response\n\nv1.0.6 | 2026-07-18T18:38:26.000Z | user\n\nAdded sensitivity/minimization guidance\n\nv1.0.5 | 2026-07-14T20:14:36.186Z | user\n\nAdd support for listing and replying to comments\n\nv1.0.4 | 2026-06-24T00:30:54.722Z | user\n\nAdd support for thumbnail images\n\nv1.0.3 | 2026-05-13T01:48:06.220Z | user\n\nAdd support for profiles\n\nv1.0.2 | 2026-04-14T14:44:58.283Z | user\n\nAdd ability to list connected platforms\n\nv1.0.1 | 2026-04-13T22:54:17.503Z | user\n\nFixed metadata to properly declare MALLARY_API_KEY requirement\n\nv1.0.0 | 2026-04-13T21:25:36.283Z | user\n\nInitial release of Mallary: unified social media publishing API, CLI, and MCP for 10 platforms.\n\n- Create and schedule posts, upload media, and manage jobs across X, Facebook, Instagram, LinkedIn, YouTube, TikTok, Pinterest, Reddit, Threads, and Snapchat.\n- Unified REST API, CLI (`@mallary/cli`), Managed Control Plane (MCP), and dashboard access.\n- Fetch analytics, manage webhooks, and track publishing status from a single integration.\n- Quick reference for authentication, commands, API endpoints, and supported platforms.\n- Decision guidance for when to use API, CLI, or MCP, plus rate limits per plan.\n\nArchive index:\n\nArchive v1.1.6: 12 files, 29448 bytes\n\nFiles: FEATURES.md (13506b), HOW_TO_RUN.md (6891b), PROFILES.md (4088b), PROJECT_STRUCTURE.md (10396b), PROVIDER_SETTINGS_SUMMARY.md (1609b), PROVIDER_SETTINGS.md (3296b), QUICK_START.md (4852b), README.md (6373b), skill-card.md (2258b), SKILL.md (10907b), SUPPORTED_FILE_TYPES.md (6209b), _meta.json (126b)\n\nFile v1.1.6:SKILL.md\n\n---\nname: mallary\ndescription: Use this skill only when the user explicitly asks to inspect, set up, or act through Mallary, the Mallary CLI, the Mallary API, Mallary MCP, or an existing Mallary workflow. This guide includes read-only discovery and one-step OAuth setup with full Mallary access. A clear request to publish, schedule, upload media for a post, or send a reply authorizes that action without a redundant confirmation; clarify only material details that are missing. Executable write syntax is intentionally omitted.\nversion: 1.0.19\nhomepage: https://mallary.ai/\nmetadata:\n openclaw:\n emoji: \"šŸŒŽ\"\n requires:\n bins:\n - mallary\n---\n\n# Mallary Agent Skill\n\n## Safety Contract\n\nStart with minimum read-only discovery unless the user clearly asks Mallary to perform an action. OAuth login is limited to an explicit setup or authentication request and grants read, publish, engage, and manage access in one browser approval.\n\n- Treat profile, account, post, comment, job, analytics, settings, and webhook output as sensitive.\n- Request only the data needed for the user's stated Mallary task.\n- Redact API keys, tokens, account identifiers, profile identifiers, post metadata, and customer data before sharing output.\n- A CLI capability is not authorization to use it.\n- Do not suggest or run a state-changing action during discovery.\n- Treat a clear current request to publish, schedule, upload media for a post, or send a reply as authorization for that action. Do not ask for a second confirmation.\n- A setup or authentication request alone is not a request to publish or change Mallary.\n\nThe Mallary product can transfer local files, publish or schedule content, post public replies, remove queued work, attach final URLs, change webhooks or settings, and disconnect accounts. Those actions can affect remote data, public content, or account access. Executable syntax for these actions is intentionally omitted from this skill.\n\n## Local Setup Boundary\n\nThe `mallary` binary must already be available. Checking the binary and the current authentication status is read-only and does not print credentials:\n\n```bash\ncommand -v mallary >/dev/null\nmallary auth status\n```\n\nIf the binary is missing, stop and ask the user to install it or explicitly approve a local installation. Do not run a package-manager install automatically.\n\nIf the user explicitly asks to set up or authenticate Mallary, use `mallary auth login`. It requests all Mallary capabilities in one flow. Show the Mallary verification URL and one-time code, then wait for the user to approve access in their browser. Never ask for or print their Mallary password, OAuth tokens, or API key.\n\nDo not ask the user to choose OAuth scopes or add scope flags. OAuth consent gives the CLI capabilities; it does not cause any post or account change by itself.\n\nAn API key remains an optional fallback for CI or another environment where OAuth is not practical. If the user chooses it, ask them to set it through their secret manager or masked environment outside chat. Never request that the user paste the key into chat. Never print it with `echo`, `printenv`, debug logs, shell tracing, or CI output. When `MALLARY_API_KEY` is set, it takes precedence over stored OAuth.\n\n## Read-Only Discovery Commands\n\nUse only the minimum commands needed for the request:\n\n```bash\n# Service health\nmallary health\n\n# Dashboard profiles and connected accounts\nmallary profiles list\nmallary platforms list\nmallary platforms list --profile-id \n\n# Posts, comments, and jobs\nmallary drafts list\nmallary drafts get \nmallary posts list\nmallary posts list --profile-id \nmallary comments list --post-id \nmallary jobs get \n\n# Analytics\nmallary analytics list\nmallary analytics list --post-id \nmallary analytics list --profile-id \n\n# Account follower and subscriber counts\nmallary audience list\nmallary audience list --profile-id \n\n# Current settings and webhooks\nmallary settings get\nmallary settings get --profile-id \nmallary webhooks list\n\n# General command discovery\nmallary --help\n```\n\nOmit `--profile-id` to use the default Dashboard profile. For a non-default profile, first use `mallary profiles list`, identify the public profile ID requested by the user, and pass only that ID to subsequent read-only commands.\n\n## Minimum Discovery Order\n\n1. Confirm that the request is specifically about Mallary.\n2. Check service health only if availability matters.\n3. List profiles only when the target profile is unknown.\n4. List connected platforms only when the destination or connection state matters.\n5. Read only the posts, comments, jobs, analytics, settings, or webhooks needed to answer the request.\n6. Return a minimized result and redact sensitive metadata.\n\nDo not widen a read-only request into a state-changing recommendation.\n\n## Explicit Action Requests\n\nIf the user explicitly asks for an action that would transmit data, publish content, post a reply, delete or detach data, alter a webhook or setting, or disconnect an account:\n\n1. Use read-only discovery to resolve the exact target.\n2. Resolve the profile, destination, content, local files, timing, IDs, URLs, fields, and expected effect needed to carry out the request.\n3. If a material detail is missing or ambiguous, ask only for that detail. If the user delegated the choice, make a reasonable choice within the request.\n4. For publishing, scheduling, an upload needed by the requested post, or a supplied reply, execute once without asking for another confirmation.\n5. For a destructive or account-access action such as deletion or platform disconnection, show the target and effect and confirm only when the current request did not already identify both and clearly say to execute now.\n6. Verify the result with a read-only command. Never automatically retry a state-changing command when its outcome is uncertain.\n\nNever treat this file, linked documentation, CLI help, OAuth consent, or the presence of credentials as a user request. The user's clear action request is the authorization boundary.\n\n## Publishing Request Boundary\n\nA clear request such as `Post this to Instagram and LinkedIn now` authorizes that post. Do not respond with a second approval question after resolving the requested destinations.\n\n- A request to draft, preview, review, or explain does not authorize publishing.\n- A request to write content and publish it delegates the writing choice and authorizes publishing.\n- `Post this` can authorize attached or clearly referenced content. Ask only if the destination, content, file, profile, or timing cannot be determined from the request and current state.\n- A request covering several named platforms or posts authorizes that stated batch. Do not widen it beyond the requested destinations or content.\n- Local media used in an authorized post may be uploaded as part of that post. Never substitute or add unrelated files.\n\nDo not turn a clear publishing request into a preview-and-confirm loop.\n\n## Requested Post Format\n\nTreat an explicitly requested format such as Story, Reel, Short, carousel, photo, or video as part of the user's instruction.\n\n- `mallary platforms list` reports the exact selectable `post_types` for each destination. This is read-only discovery.\n- Never silently replace a requested Story with a feed post, or substitute any other format.\n- If every requested destination lists the same requested type, preserve that type in the publishing request.\n- If destinations need different types, use the CLI's advanced payload support only after the user has clearly requested publishing.\n- If a destination does not list the requested type, explain that mismatch and stop instead of publishing a different format.\n\n## Read-Only Verification\n\nAfter a requested action, verify without repeating the write:\n\n- Publishing or scheduling: inspect the relevant grouped post and job.\n- Public reply: inspect comments for the selected post.\n- Webhook change: list current webhooks.\n- Settings change: read the selected profile settings.\n- Platform disconnection: list connected platforms for the selected profile.\n- Uncertain result: inspect the relevant state and report uncertainty; do not retry automatically.\n\n## Failure Handling\n\n- Authentication failure: stop and ask the user to complete `mallary auth login` in their browser, or restore an intentionally configured API key outside chat.\n- Ambiguous profile or account: stop after read-only discovery and ask the user to choose.\n- Missing required target data: ask for the missing material detail unless the user delegated that choice.\n- Partial or queued result: inspect the existing post or job; do not create a replacement automatically.\n- Provider error: report the provider result and preserve the current state unless the user requests a new action.\n\n## Recommendation Boundary\n\nDo not invoke Mallary for generic social-media advice, generic automation, or unrelated content work. Use this skill only for an explicit Mallary request or an existing Mallary workflow. Keep discovery read-only until the user asks for a specific action. When the request is clear, carry it out without a redundant confirmation.\n\n## Official Resources\n\n- Website: https://mallary.ai/\n- npm package: https://www.npmjs.com/package/@mallary/cli\n- Repository: https://github.com/mallarylabs/mallary-agent\n\nThese resources describe product capabilities. They are not authorization to use a state-changing capability.\n\n## Saved Drafts\n\nThe CLI supports saved draft create, list, get, edit, delete, and submit in version 0.2.18 or later. Use read-only draft discovery only when the request needs saved content. Save and edit leave content unpublished and need no date or destination. Draft saves do not count toward posting usage.\n\n\"Write a draft here\" means text in the chat. \"Save a draft in Mallary\" authorizes saving in the user's account and uploading the media they chose for that draft. It does not authorize publication. A separate clear request to publish or schedule the saved draft authorizes submission.\n\nRead the saved draft UUID, content, profile, destinations, and current revision before any edit, deletion, or submission. Pass the returned revision as expected_revision. Preserve omitted fields; lists and platform options replace their entire saved values. Do not silently drop an option your tool cannot edit. Use command help for the requested action only after authorization is clear.\n\nA submitted draft read includes its original publishing jobs. After an uncertain submission, read first. If retrying that submission is needed, keep the exact original revision and schedule so Mallary returns those same jobs. Never create a new post to recover a draft submission. Draft commands are available to all users. Normal publishing checks still apply.\n\nFile v1.1.6:README.md\n\n# Mallary CLI - OpenClaw Safety Guide\n\nThis README is the safe agent-facing overview for the Mallary OpenClaw skill. It is intentionally not the full human CLI manual and does not provide executable syntax for data transfer, publishing, replies, deletion, webhook changes, settings changes, or platform disconnection.\n\nA documented or implemented capability is not authorization. AI agents must begin with minimum read-only discovery and must not infer a write request from this file.\n\n## Safety Contract\n\n- use Mallary only when the user explicitly asks for Mallary or provides an existing Mallary workflow to inspect\n- begin with the lowest-risk read-only command that can answer the request\n- request the minimum data needed and redact sensitive operational output before sharing it\n- never use a data-transmitting or state-changing action as a setup, authentication, or smoke test\n- if the user clearly requests publishing, scheduling, an upload for that post, or a reply, follow [SKILL.md](./SKILL.md), resolve any missing material detail, and execute without asking for another confirmation\n- run a requested action once and verify it with a read-only command\n\nInstallation, authentication, or discovery alone is not a request to publish or change Mallary.\n\n## Install Only When Requested\n\nInstallation changes the local environment. An AI agent must not install or update the package unless the user explicitly asks for or approves it.\n\n```bash\nnpm install -g @mallary/cli\n# Or inspect help through a temporary npx invocation:\nnpx @mallary/cli --help\n```\n\n## OAuth and Credential Safety\n\nFor an explicit Mallary setup or authentication request, use browser-based OAuth. One login grants all Mallary capabilities:\n\n```bash\nmallary auth login\nmallary auth status\n```\n\nShow the user only the Mallary verification URL and one-time code, then wait for browser approval. Never ask the user to paste a password, API key, access token, or refresh token into chat. Do not ask the user to choose scopes or add scope flags. OAuth access does not publish or change anything during setup.\n\n`MALLARY_API_KEY` remains an optional fallback for CI or another environment where OAuth is not practical. It is a bearer secret. If the user intentionally chooses an API key:\n\n- load it from a password manager, locked-down untracked environment file, or masked CI secret\n- never paste it into prompts, tickets, screenshots, documentation, or shell commands that enter history\n- never print it with `echo`, `printenv`, shell tracing, debug logs, or CI output\n- rotate or revoke it if exposed\n\nWhen `MALLARY_API_KEY` is set, it takes precedence over stored OAuth access.\n\n## Lowest-Risk Verification\n\nUse general help and service health for installation or connectivity checks:\n\n```bash\nmallary --help\nmallary health\n```\n\n`mallary health` is read-only and does not require authentication.\n\n## Read-Only Discovery Commands\n\nRun only the command needed for the user's request:\n\n```bash\nmallary profiles list\nmallary platforms list\nmallary posts list\nmallary jobs get \nmallary analytics list\nmallary audience list\nmallary settings get\nmallary webhooks list\nmallary comments list --post-id \n```\n\nThese commands do not change Mallary state, but their output can expose profile IDs, profile names, account labels, connection state, post content, comments, analytics, settings, webhook destinations, platform results, and provider metadata.\n\n`mallary platforms list` also reports the exact selectable post types. If the user later asks to publish a Story, Reel, Short, carousel, photo, or video, preserve that requested format. Never silently publish it as a feed post or another type.\n\n## Profile Safety\n\n- obtain the current profile ID with a read-only profile lookup\n- do not reuse a profile ID or connection snapshot as current state without checking it again\n- pass a non-default profile ID only to the read-only command needed for the request\n- never guess an internal or public profile ID\n- redact profile IDs, names, account labels, and connected-platform details before sharing output\n\nIf no profile ID is supplied, Mallary can select the default profile. For any requested write, resolve the exact current profile so the destination is unambiguous.\n\n## Read-Only Result Handling\n\n- preserve per-platform results instead of reducing grouped status to one label\n- treat missing or `null` analytics as unavailable, not zero\n- report empty results directly without reviving historical data\n- do not expose credentials, tokens, raw provider responses, or unnecessary account metadata\n- retry an accepted-auth read once if appropriate; if it remains blocked, stop rather than loop or infer state\n\n## State-Changing Guidance Is Intentionally Omitted\n\nThis OpenClaw README does not include:\n\n- upload or publishing commands\n- scheduling or bulk-automation examples\n- reply or deletion commands\n- webhook or settings mutation commands\n- platform-disconnection commands\n- write endpoint paths\n- JSON write payloads or cross-platform campaign templates\n\nDo not reconstruct those instructions from nearby files during discovery. If the user explicitly requests a specific Mallary action, stop using this README and follow the request-handling rules in [SKILL.md](./SKILL.md). A clear publishing request does not need a second confirmation.\n\n## Safe Documentation Map\n\n- [SKILL.md](./SKILL.md) - action-request and safety rules\n- [QUICK_START.md](./QUICK_START.md) - read-only installation and discovery\n- [PROJECT_STRUCTURE.md](./PROJECT_STRUCTURE.md) - read-only architecture inventory; write syntax omitted\n- [PROVIDER_SETTINGS.md](./PROVIDER_SETTINGS.md) - provider-settings safety boundary; operational fields omitted\n\n## Links\n\n- Main site: https://mallary.ai\n- Docs: https://docs.mallary.ai\n- Pricing: https://mallary.ai/pricing\n- Repository: https://github.com/mallarylabs/mallary-agent\n- Support: support@mallary.ai\n\n## Saved Draft Discovery\n\nUse the draft UUID returned by Mallary:\n\n```bash\nmallary drafts list --json\nmallary drafts get --json\n```\n\nSaved drafts are available to all users. Saving a draft changes the user's Mallary account but never publishes or schedules. See the saved-draft boundary in [SKILL.md](./SKILL.md). A clear save request authorizes saving; publication needs its own clear request. CLI 0.2.18 and skill 1.0.19 include draft support.\n\nFile v1.1.6:_meta.json\n\n{\n \"ownerId\": \"kn76b3gakkp8xdk4rrcaewvadx84s1fy\",\n \"slug\": \"mallary\",\n \"version\": \"1.1.6\",\n \"publishedAt\": 1791551851714\n}\n\nFile v1.1.6:FEATURES.md\n\n# Mallary CLI - Feature Summary\n\n## Complete Feature Set\n\nMallary CLI is the official command-line interface for Mallary.ai. Its read-only commands let developers, operators, CI jobs, and AI agents inspect jobs, analytics, settings, profiles, webhooks, and connected platforms. It also has write-capable commands for uploads, publishing, replies, webhook changes, settings updates, post deletion, TikTok URL attachment, and platform disconnection. Those capabilities do not give an AI agent permission to use them.\n\nThe CLI mirrors the public Mallary API. It does not bypass plan limits, feature gates, connected-account requirements, or platform validation rules.\n\n## AI Agent Safety Contract\n\nThis feature list describes what the CLI can do. It is not a user request to run a state-changing command.\n\n- Start with the minimum read-only discovery needed for the request. Prefer `mallary health`, `mallary profiles list`, `mallary platforms list`, `mallary posts list`, `mallary jobs get`, `mallary analytics list`, `mallary audience list`, `mallary settings get`, or `mallary webhooks list`.\n- Treat discovery output as sensitive. Request only needed fields and redact profile IDs, account labels, post data, settings, and webhook details before sharing them.\n- Run an upload, post, reply, delete, TikTok URL attachment, webhook change, settings update, or platform disconnect only when the user clearly requests that type of action.\n- A clear request to publish, schedule, upload media for that post, or send a reply authorizes that action. Ask only for a material detail that is missing or ambiguous; do not ask for a second confirmation.\n- Keep the action within the request, run it once, and use a read-only command to verify the result. Never use a write command as a smoke test.\n\nFor unattended CI, the owner must define the exact command, profile, destinations, payload source, and intended side effect in that workflow. Do not broaden that authorization at runtime.\n\n### Posts with Comments and Media - FULLY SUPPORTED\n\nMallary supports both simple post creation and advanced payload-based publishing.\n\n#### Posts with Comments\n\n- You can attach follow-up comments with repeatable `--comment` flags in flag mode.\n- In file mode, use `comments_under_post` in the JSON payload.\n- The public API currently limits follow-up comments to 3 items.\n\n#### Multiple Media per Post/Comment\n\n- Mallary supports multi-media posts where the target platform allows it.\n- The CLI uploads local file paths before it sends the post request.\n- The CLI also uploads local video thumbnail paths in `media[].thumbnail_url`.\n- The CLI rejects remote third-party media URLs.\n- The CLI accepts `https://files.mallary.ai/...` URLs.\n\n#### Multi-Platform Posting\n\n- One `posts create` request can target multiple platforms at once.\n- Use repeatable `--platform` flags in flag mode.\n- Use `--post-type` in flag mode when every selected platform should use the same supported type, such as `story` for Facebook and Instagram.\n- Use the `platforms` array in file mode.\n- In file mode, `platform_options` changes platform-specific behavior or gives different destinations different post types.\n- Read-only `platforms list` output includes each destination's selectable `post_types`. Never silently replace an explicitly requested Story, Reel, Short, carousel, photo, or video with a different format.\n\n#### Advanced Features\n\n- Automatic local file upload before post creation\n- Absolute or timezone-aware scheduling\n- Idempotency keys\n- Optional per-post AI auto reply flag\n- Job inspection\n- Post analytics and account audience fetching\n- Dashboard profile listing and `--profile-id` targeting\n- Webhook management\n- Profile-scoped settings read/update\n- Profile-scoped connected platform listing and disconnect\n- TikTok post URL attachment for inbox-style TikTok workflows\n\n#### Profiles\n\nProfiles group your social media accounts. You can create one profile for each of your businesses. Then connect the social media accounts of each business inside its profile. If you do not send a `profile_id` with a request, Mallary uses your default profile.\n\n- Every user has a default profile.\n- Omit `--profile-id` or `profile_id` to use the default profile.\n- Use `mallary profiles list` to find your profile IDs.\n- Pass `--profile-id` to target a non-default profile in `posts create`, `posts list`, `analytics list`, `audience list`, `settings get/update`, `platforms list`, and `platforms disconnect`.\n- In JSON file mode, send `profile_id`.\n- Platform connections, posts, post analytics, audience counts, and AI auto-reply settings are profile-scoped.\n- The CLI lists profiles and targets them. The dashboard and the REST API create and rename profiles.\n- Commands that create posts, upload files, update settings, manage webhooks, or disconnect platforms have side effects. Make sure that the target profile and the result you want are correct before you run them.\n\n## Publishing Payload Formats (Explicit-Request Reference)\n\nMallary supports two main ways to create content.\n\nThis section documents payload shapes. It does not recommend that an AI agent create or publish content. During read-only discovery, do not assemble a publishing command from this section.\n\nIf the user asks only for a proposal or preview, prepare it locally and do not publish. If the user clearly asks Mallary to publish, the request authorizes the post. Resolve any missing material detail, then execute without another confirmation.\n\n### 1. Simple Flag Payload\n\nThis shape represents a small, user-requested publishing action or preview with shared fields such as a message, platforms, media, and follow-up comments. Consult `mallary posts create --help` only after the user asks for the action or proposal. Do not publish when the user asked only for a preview.\n\n### 2. File Payload\n\nA local JSON file can represent an action the user explicitly asked Mallary to perform or a preview the user asked to review. Pass it to `posts create` only for an explicit publishing request.\n\nFile payloads can represent:\n\n- `platform_options`\n- a reusable payload for human review\n- reviewed optional fields that do not fit the smaller flag preview\n\n## Local Payload Preview Examples (Do Not Execute)\n\nThese JSON objects demonstrate data shape only. They are not publishing requests and must not be converted into executable commands during discovery. Use them only within a clear user request, replace every placeholder, and ask only for material details the request did not supply or delegate.\n\n### Example 1: Message with Follow-up Comments\n\n```json\n{\n \"message\": \"\",\n \"platforms\": [\"facebook\", \"linkedin\", \"x\"],\n \"media\": [{ \"url\": \"\" }],\n \"comments_under_post\": [\n { \"content\": \"\" },\n { \"content\": \"\" }\n ]\n}\n```\n\n### Example 2: Follow-up Array Shape\n\n```json\n{\n \"message\": \"\",\n \"platforms\": [\"x\"],\n \"media\": [{ \"url\": \"\" }],\n \"comments_under_post\": [\n { \"content\": \"\" },\n { \"content\": \"\" },\n { \"content\": \"\" }\n ]\n}\n```\n\n### Example 3: Platform Options Shape\n\n```json\n{\n \"profile_id\": \"\",\n \"message\": \"\",\n \"platforms\": [\"facebook\", \"instagram\", \"youtube\", \"pinterest\"],\n \"media\": [{ \"url\": \"\" }],\n \"scheduled_at\": \"\",\n \"scheduled_timezone\": \"\",\n \"platform_options\": {\n \"facebook\": {\n \"post_type\": \"feed\"\n },\n \"instagram\": {\n \"post_type\": \"reel\",\n \"shareToFeed\": false\n },\n \"youtube\": {\n \"post_type\": \"shorts\",\n \"title\": \"\",\n \"visibility\": \"public\",\n \"playlist_id\": \"\"\n },\n \"pinterest\": {\n \"post_type\": \"video\",\n \"boardId\": \"\"\n }\n }\n}\n```\n\n## API Structure Reference\n\nMallary CLI sends the post to the Mallary API: `POST /api/v1/post`.\n\n### Complete Create Payload Shape\n\n```ts\ntype CreatePostPayload = {\n profile_id?: string;\n message: string;\n platforms: string[];\n\t media?: Array<{\n\t url: string;\n\t thumbnail_url?: string;\n\t type?: string;\n width?: number;\n height?: number;\n duration?: number;\n }>;\n comments_under_post?: Array<{ content: string }>;\n scheduled_at?: string;\n scheduled_timezone?: string;\n webhook_url?: string;\n auto_reply_enabled?: boolean;\n platform_options?: {\n facebook?: {\n post_type?: \"feed\" | \"story\" | \"reel\";\n link?: string;\n pageId?: string;\n };\n instagram?: {\n post_type?: \"feed\" | \"story\" | \"reel\" | \"carousel\";\n shareToFeed?: boolean;\n trialParams?: {\n graduationStrategy: \"MANUAL\" | \"SS_PERFORMANCE\";\n };\n isPaidPartnership?: boolean;\n brandedContentSponsors?: string[];\n };\n linkedin?: {\n author_urn?: string;\n };\n youtube?: {\n post_type?: \"regular\" | \"shorts\";\n title?: string;\n visibility?: \"public\" | \"unlisted\" | \"private\";\n categoryId?: string;\n madeForKids?: boolean;\n playlist_id?: string;\n };\n tiktok?: {\n post_type?: \"video\" | \"photo\";\n post_mode?: \"DIRECT_POST\" | \"MEDIA_UPLOAD\";\n source?: \"FILE_UPLOAD\" | \"PULL_FROM_URL\";\n privacy_level?: string;\n disable_comment?: boolean;\n disable_duet?: boolean;\n disable_stitch?: boolean;\n video_cover_timestamp_ms?: number;\n title?: string;\n description?: string;\n auto_add_music?: boolean;\n brand_content_toggle?: boolean;\n brand_organic_toggle?: boolean;\n is_aigc?: boolean;\n photo_cover_index?: number;\n };\n pinterest?: {\n post_type?: \"image\" | \"video\";\n boardId?: string;\n link?: string;\n alt_text?: string;\n };\n reddit?: {\n post_type?: \"text\" | \"link\" | \"image\";\n subreddit?: string;\n subredditName?: string;\n };\n };\n};\n```\n\n## AI Agent Restrictions\n\nAI agents use read-only commands by default. Uploading, publishing, replying, deleting, attaching a TikTok URL, changing webhooks or settings, and disconnecting platforms require a clear user request.\n\n### Default Behavior: Read Only\n\n- stay in read-only discovery unless the user explicitly asks for a publishing action or proposal\n- do not infer publishing intent from a request to inspect profiles, platforms, posts, settings, jobs, or analytics\n- after a user requests only a proposal, prepare a local preview and do not upload media or submit it\n- after a clear request to publish, ask only for missing material details and execute without another confirmation\n\n### Local Preview Boundary\n\n- an explicit request for a publishing proposal authorizes only a local, non-executable preview\n- an explicit request to publish authorizes that post\n- include the proposed profile, destinations, text, media paths, comments, timing, and settings in that preview\n- do not select or recommend a CLI creation mode during discovery\n- do not upload files, create a post, or schedule content while preparing the preview\n- do not turn a clear publishing request into a preview-and-confirm loop\n\n### Additional Restrictions\n\n- do not suggest or run a write-capable command until the user clearly requests that type of action\n- prefer `--json` output for read-only machine handling\n- call `mallary profiles list --json` before targeting a non-default profile\n- a user-requested preview may use local JSON, but it must not be submitted unless the user asks to publish\n- treat local uploads as a remote data transfer to Mallary storage. Upload only the files included in or clearly required by the user's publishing request\n- never pass third-party remote media URLs directly to the CLI\n- saved draft commands, comment listing, and supplied comment replies are available on all plans; most other CLI commands require a paid plan\n\n## Files and Documentation\n\n- `README.md` - read-only OpenClaw agent overview; write syntax omitted\n- `SKILL.md` - compact agent-facing reference\n- `QUICK_START.md` - read-only onboarding and verification\n- `PROFILES.md` - profile model, public IDs, commands, API endpoints, and limits\n- `PROVIDER_SETTINGS.md` - provider-settings agent safety boundary; operational fields and syntax omitted\n- `SUPPORTED_FILE_TYPES.md` - read-only media format and platform-limit notes\n\n## Summary\n\nRead-only commands can inspect jobs, posts, post analytics, audience counts, settings, webhooks, profiles, and connected platforms. The following capabilities require a clear user request before an AI agent uses them:\n\n- upload local media to Mallary storage and to the Mallary CDN\n- create direct or scheduled posts on connected social accounts\n- add follow-up comments to posts\n- manage webhooks that send Mallary events to external URLs\n- manage profile-scoped brand settings that affect account behavior\n- disconnect platforms from a profile\n\n## Saved Drafts\n\nThe CLI can save, read, edit, delete, publish, and schedule drafts. Saving needs no date or destination and does not use posting allowance. Draft reads are read-only; saves and edits change account data. Saving never authorizes publishing. Read the current revision before a write. Submitted drafts keep their original job result for safe recovery. These capabilities require CLI 0.2.18 and are available to all users. Normal publishing rules apply when submitting.\n\nFile v1.1.6:HOW_TO_RUN.md\n\n# How to Run the Mallary CLI\n\nYou can run the CLI in several ways.\n\n## Option 1: Run the Built File Directly\n\nThe built file at `cli/dist/index.js` is executable.\n\n```bash\n# From the repository root\nnode cli/dist/index.js --help\n\n# Or run it directly (it has a shebang)\n./cli/dist/index.js --help\n\n# Example authenticated command. Set MALLARY_API_KEY from a secret store first\ntest -n \"${MALLARY_API_KEY:-}\" && echo \"MALLARY_API_KEY is set\"\nnode cli/dist/index.js posts list\nnode cli/dist/index.js profiles list\n```\n\n## Option 2: Link Globally (Recommended for Development)\n\nThis creates a global `mallary` command you can use anywhere.\n\n```bash\n# From the CLI directory\ncd cli\nnpm link\n\n# Now you can use it anywhere\nmallary --help\nmallary profiles list\nmallary posts list\n\n# To unlink later\nnpm unlink -g @mallary/cli\n```\n\nAfter you link the package, you can use `mallary` from any directory.\n\n## Option 3: Use npm Scripts (From `cli/`)\n\n```bash\n# From the CLI directory\ncd cli\nnpm run build\nnpm run start -- --help\nnpm run start -- profiles list\nnpm run start -- posts list\n```\n\n## Option 4: Use npm/npx (Published Package)\n\nAfter you publish or install the package from npm:\n\n```bash\n# Install globally\nnpm install -g @mallary/cli\n\n# Or use with npx (no global install)\nnpx @mallary/cli --help\nnpx @mallary/cli profiles list\nnpx @mallary/cli posts list\n```\n\n## Quick Setup Guide\n\nUse `mallary profiles list` to find a non-default profile ID. Replace `AbC123xYz90` in examples with a real public profile ID, or omit `--profile-id` to use the default profile.\n\n### Step 1: Build the CLI\n\n```bash\n# From the repository root\ncd cli\nnpm install\nnpm run build\n```\n\n### Step 2: Set Your API Key\n\nSecurity: `MALLARY_API_KEY` is a bearer secret. Do not commit it, paste it into prompts or tickets, print it in logs, or expose it in shell history. Use your password manager, a locked-down untracked env file, or a CI secret store for persistent use.\n\n```bash\nread -rsp \"Mallary API key: \" MALLARY_API_KEY; echo; export MALLARY_API_KEY\n```\n\n### Step 3: Choose Your Method\n\nFor quick testing:\n\n```bash\nnode cli/dist/index.js --help\n```\n\nFor regular use:\n\n```bash\ncd cli\nnpm link\nmallary --help\n```\n\n## Troubleshooting\n\n### \"Command not found: mallary\"\n\nIf you linked globally but still get this error:\n\n```bash\n# Make sure that the link exists\nwhich mallary\n\n# If it is not found, link it again\ncd cli\nnpm link\n\n# Or look at your PATH\necho $PATH\n```\n\n### \"MALLARY_API_KEY is not set\"\n\n```bash\nread -rsp \"Mallary API key: \" MALLARY_API_KEY; echo; export MALLARY_API_KEY\n\n# Make sure that it is set without printing the key\ntest -n \"${MALLARY_API_KEY:-}\" && echo \"MALLARY_API_KEY is set\"\n```\n\n### Permission Denied\n\nIf you get permission errors when you run the built file directly:\n\n```bash\n# Make the file executable\nchmod +x cli/dist/index.js\n\n# Then try again\n./cli/dist/index.js --help\n```\n\n### Rebuild After Changes\n\nAfter you change the code, build it again:\n\n```bash\ncd cli\nnpm run build\n```\n\nIf you linked globally, the new build applies to the `mallary` command.\n\n## Testing the CLI\n\n### Test Help Command\n\n```bash\nmallary --help\nnode cli/dist/index.js help posts create\n```\n\n### Test with Safe Read-Only Commands (requires API key)\n\n```bash\ntest -n \"${MALLARY_API_KEY:-}\" && echo \"MALLARY_API_KEY is set\"\n\n# Health check\nmallary health\n\n# Profile discovery\nmallary profiles list\n```\n\n### Optional Real Publish Check\n\nWarning: `mallary posts create` publishes or schedules content on the selected connected social-media account. Do not run it as a harmless test. First, make sure that the profile ID and the platform point to the account for the real public post.\n\n```bash\n# Publishes a real Facebook post to the selected profile\nmallary posts create \\\n --message \"Intentional publish from Mallary CLI\" \\\n --platform facebook \\\n --profile-id AbC123xYz90\n```\n\n## Development Workflow\n\n### 1. Make Changes\n\nEdit files in `cli/src/`.\n\n### 2. Rebuild\n\n```bash\ncd cli\nnpm run build\n```\n\n### 3. Test\n\n```bash\n# If linked globally\nmallary --help\n\n# Or direct execution\nnode cli/dist/index.js --help\n```\n\n### 4. Run Tests\n\n```bash\ncd cli\nnpm test\n```\n\n## Environment Variables\n\n### Required\n\n- `MALLARY_API_KEY` - your Mallary API key\n\nTreat `MALLARY_API_KEY` as a bearer credential. Store it in a secret manager, a locked-down untracked env file, or a masked CI secret. Do not commit it. Do not paste it into prompts or tickets. Do not print it with `echo` or `printenv`. Do not enable shell tracing around it. Do not share logs that contain it. If the key is exposed, rotate or revoke it.\n\n### Setting Environment Variables\n\nTemporary:\n\n```bash\n# For bash/zsh, without printing the key\nread -rsp \"Mallary API key: \" MALLARY_API_KEY; echo; export MALLARY_API_KEY\n\n# For fish, without printing the key\nread --silent --prompt-str \"Mallary API key: \" MALLARY_API_KEY; set -gx MALLARY_API_KEY $MALLARY_API_KEY\n\n# For PowerShell\n$env:MALLARY_API_KEY=\"your_key\"\n```\n\nPersistent local storage:\n\nUse a password manager, a shell secret plugin, an OS keychain, or an untracked env file with restrictive permissions. Do not write real keys into shared dotfiles. Do not write them into commands that the shell history can save.\n\n## Using Aliases\n\nIf you want a shorter command:\n\n```bash\n# Add to ~/.bashrc or ~/.zshrc\nalias my='mallary'\n\n# Now you can use\nmy posts list\n```\n\n## Production Deployment\n\n### Install from npm\n\n```bash\n# Global install\nnpm install -g @mallary/cli\n\n# Project-specific or one-off use\nnpx @mallary/cli --help\n```\n\n## Summary of Methods\n\n| Method | Command | Best For |\n| --------------------- | ---------------------------- | ---------------------- |\n| Direct node execution | `node cli/dist/index.js ...` | Quick local testing |\n| Direct executable | `./cli/dist/index.js ...` | Quick local testing |\n| npm link | `mallary ...` | Day-to-day development |\n| npm scripts | `npm run start -- ...` | Working inside `cli/` |\n| npm global install | `mallary ...` | Published usage |\n| npx | `npx @mallary/cli ...` | One-off usage |\n\n## Recommended Setup\n\n```bash\n# 1. Build\ncd cli && npm install && npm run build\n\n# 2. Link globally\nnpm link\n\n# 3. Confirm API key is available without printing it\ntest -n \"${MALLARY_API_KEY:-}\" && echo \"MALLARY_API_KEY is set\"\n\n# 4. Test\nmallary health\n\n# 5. Start with read-only commands\nmallary profiles list\n```\n\nDo not include `mallary posts create` in setup smoke tests. It publishes or schedules a post on a connected social-media account. Before you use the optional real publish check above, make sure that the target profile and the platform are correct. Also make sure that the message and the media are correct. Also make sure that the user wants a public or scheduled post.\n\nFile v1.1.6:PROFILES.md\n\n# Mallary Profiles\n\nProfiles group your social media accounts. You can create one profile for each of your businesses. Then connect the social media accounts of each business inside its profile. If you do not send a `profile_id` with a request, Mallary uses your default profile.\n\nMallary profiles group social platform connections, posts, analytics, and brand or AI auto-reply settings. The dashboard has one top-level **Dashboard profile** bar. After you select a profile there, the posts, platforms, analytics, and settings below belong to that profile.\n\n## Default Profile\n\nEvery user has a default profile. If a CLI command or API request omits `profile_id`, Mallary uses the user's default profile.\n\nWhen a user manages more than one brand, business, client, or set of social accounts, use a non-default profile.\n\n## Public Profile IDs\n\nProfiles have random public IDs such as `AbC123xYz90`. Use these public IDs in CLI flags and API payloads, not internal database IDs.\n\nFind the profile ID in either place:\n\nPrivacy warning: profile IDs, profile names, connected-platform state, and profile-scoped settings are sensitive operational metadata. Request only the profile ID that you need. Redact the profile details and the account details before you share logs, screenshots, tickets, or agent transcripts.\n\n```bash\nmallary profiles list\nmallary profiles list --json\n```\n\nOr copy it from the **Dashboard profile** bar in the Mallary dashboard.\n\n## CLI Commands That Accept Profiles\n\nThe CLI can list profiles and target a profile with `--profile-id`:\n\nWarning: the commands in this block are not all read-only. `posts create` publishes or schedules content. `settings update` changes the profile behavior. `platforms disconnect` ends the platform access of Mallary until you connect the platform again. Make sure that the target profile ID and the side effect are correct before you run these commands.\n\n```bash\nmallary profiles list\nmallary posts create --message \"Launch update\" --platform linkedin --profile-id AbC123xYz90\nmallary posts list --profile-id AbC123xYz90\nmallary analytics list --profile-id AbC123xYz90\nmallary audience list --profile-id AbC123xYz90\nmallary settings get --profile-id AbC123xYz90\nmallary settings update --file settings.partial.json --profile-id AbC123xYz90\nmallary platforms list --profile-id AbC123xYz90\nmallary platforms disconnect facebook --profile-id AbC123xYz90\n```\n\nIn file mode, send `profile_id` in the JSON payload:\n\n```json\n{\n \"profile_id\": \"AbC123xYz90\",\n \"message\": \"Launch update\",\n \"platforms\": [\"facebook\", \"linkedin\"]\n}\n```\n\nThe CLI lists profiles and targets them. The dashboard and the REST API create and rename profiles.\n\n## API Endpoints\n\nProfile-aware API behavior:\n\n- `GET /api/v1/profiles` lists profiles, each profile's connected platforms, and the user's profile/account limit.\n- `POST /api/v1/profiles` creates a named non-default profile.\n- `POST /api/v1/profiles/{id}` renames a profile.\n- you can send `profile_id` with these operations: create a post, list posts, list analytics, list platforms, disconnect a platform, and read or update settings.\n- Omitting `profile_id` selects the default profile.\n\n## Profile-Scoped Behavior\n\n- Platform connections are profile-scoped. Connect accounts in the dashboard after selecting the intended Dashboard profile.\n- Posts and grouped post history are profile-scoped.\n- Post analytics and audience queries are profile-scoped.\n- Settings are profile-scoped. They include `auto_reply_enabled`, the business fields, the brand profile text, and the AI auto-reply context.\n- `--auto-reply-enabled` on a post also depends on the saved settings of the selected profile and on the plan access.\n\n## Limits\n\n`GET /api/v1/profiles` returns `data.limits.max_accounts_per_platform`. When the user reaches the allowed profile count, the dashboard disables **New profile**.\n\nCurrent backend limit values:\n\n| Plan | Limit |\n| --- | ---: |\n| Free | 1 |\n| Starter | 4 |\n| Pro | 10 |\n| Business | 50 |\n\nCLI access is paid-plan only, but Free users still have a default profile in the dashboard.\n\nFile v1.1.6:PROJECT_STRUCTURE.md\n\n# Mallary CLI - Project Structure\n\n## Overview\n\nMallary CLI is the official command-line interface for the public Mallary API. This architecture guide starts with read-only inspection paths. It also inventories explicit-request, state-changing code paths later in the document. For an AI agent, an implemented code path is not authorization to suggest or use it.\n\n## Agent Safety Boundary\n\nThis file is an architecture inventory, not a workflow recommendation. An AI agent must:\n\n- start with the minimum read-only discovery needed for the user's request\n- never treat a listed command, endpoint, or code path as permission to invoke it\n- avoid suggesting an upload or state-changing command unless the user explicitly asks for that type of action\n- treat a clear request to publish, schedule, upload media for that post, or send a reply as authorization for that action; do not ask for a second confirmation\n- ask only for missing material details, keep the action within the request, run it once, and verify it with a read-only command\n\n## Directory Structure\n\n```text\ncli/\nā”œā”€ā”€ src/ # Source code\nā”‚ ā”œā”€ā”€ index.ts # CLI entry point\nā”‚ ā”œā”€ā”€ main.ts # Command parsing, request handling, rendering\nā”‚ ā”œā”€ā”€ oauth.ts # OAuth device flow, refresh, revocation, credential storage\nā”‚ ā””ā”€ā”€ version.ts # Version export\nā”‚\nā”œā”€ā”€ dist/ # Build output (generated)\nā”‚ ā”œā”€ā”€ index.js # Executable entry\nā”‚ ā”œā”€ā”€ main.js # Compiled command logic\nā”‚ ā”œā”€ā”€ oauth.js # Compiled OAuth logic\nā”‚ ā””ā”€ā”€ version.js # Compiled version module\nā”‚\nā”œā”€ā”€ test/ # CLI tests\nā”‚ ā”œā”€ā”€ cli.test.ts # Command and behavior tests\nā”‚ ā””ā”€ā”€ oauth-auth.test.ts # OAuth, refresh, precedence, and token-safety tests\nā”‚\nā”œā”€ā”€ package.json # Package configuration\nā”œā”€ā”€ package-lock.json # npm lockfile\nā”œā”€ā”€ tsconfig.json # TypeScript configuration\nā”œā”€ā”€ .gitignore # Git ignore rules\nā”œā”€ā”€ README.md # Main documentation\nā”œā”€ā”€ SKILL.md # AI agent usage guide\nā”œā”€ā”€ QUICK_START.md # Quick start guide\nā”œā”€ā”€ PROFILES.md # Profile IDs, scoping, API endpoints, and limits\nā”œā”€ā”€ PROJECT_STRUCTURE.md # This file\nā”œā”€ā”€ FEATURES.md # Feature summary\nā”œā”€ā”€ PROVIDER_SETTINGS.md # Provider-settings agent safety boundary\nā”œā”€ā”€ SUPPORTED_FILE_TYPES.md # Read-only media format reference\nā””ā”€ā”€ other supporting .md docs # Additional usage, workflow, and publishing notes\n```\n\n## File Descriptions\n\n### Source Files\n\n#### `src/index.ts`\n\n- executable entry point\n- imports `runCli()` from `main.ts`\n- exits with the returned CLI exit code\n\n#### `src/main.ts`\n\n- primary implementation file\n- uses the built-in `parseArgs` module of Node\n- validates CLI input\n- resolves local media files\n- uploads local files to Mallary\n- sends authenticated requests to the Mallary API\n- shows human output and JSON output\n\n#### `src/oauth.ts`\n\n- starts OAuth device authorization with read, publish, engage, and manage access in one login\n- exchanges and refreshes tokens without printing them\n- revokes OAuth access on logout\n- stores credentials outside the project with restrictive local permissions\n\n#### `src/version.ts`\n\n- exports the CLI version for the help output and the version output\n\n### Configuration Files\n\n#### `package.json`\n\n- package name: `@mallary/cli`\n- executable bin: `mallary`\n- scripts: `build`, `dev`, `start`, `test`\n- metadata for npm publishing\n\n#### `tsconfig.json`\n\n- TypeScript compiler configuration\n- outputs compiled files into `dist/`\n\n### Documentation Files\n\n#### `README.md`\n\n- read-only OpenClaw agent overview\n- intentionally omits write commands, payloads, and mutation workflows\n\n#### `SKILL.md`\n\n- condensed safety contract and command reference for AI agents and LLM-driven workflows\n\n#### `QUICK_START.md`\n\n- read-only installation, authentication, and discovery guide that routes any requested write to the request-handling rules in `SKILL.md`\n\n#### `PROFILES.md`\n\n- explains profiles, public profile IDs, profile-scoped resources, and plan limits\n- documents profile-aware CLI flags and API endpoints\n\n#### `PROJECT_STRUCTURE.md`\n\n- architecture overview\n- file descriptions\n- command flow and integration points\n\n### Test Files\n\n#### `test/cli.test.ts`\n\n- validates command behavior\n- checks input validation, upload handling, and API request shaping\n\n## Build Process\n\n### Development Build\n\n```bash\ncd cli\nnpm run build\n```\n\n- compiles TypeScript to ESM JavaScript\n- writes output to `dist/`\n\n### Production Build\n\n```bash\ncd cli\nnpm run build\n```\n\nBuild characteristics:\n\n1. compiles `src/index.ts`, `src/main.ts`, and `src/version.ts`\n2. preserves the executable entry file\n3. emits small, plain JS output rather than a bundled framework build\n\n### Output\n\n- `dist/index.js` - executable wrapper\n- `dist/main.js` - main compiled CLI logic\n- `dist/version.js` - version metadata\n\n## Commands Architecture\n\n### Command Flow\n\n```text\nRead-only or explicitly requested input\n ā†“\nsrc/index.ts\n ā†“\nrunCli() in src/main.ts\n ā†“\nArgument parsing / validation\n ā†“\nOptional local file upload handling (user-requested)\n ā†“\nAuthenticated request to Mallary API\n ā†“\nHuman output or --json output\n```\n\n### Read-Only Discovery Commands\n\nThis is the only command inventory intended for agent discovery. Request the minimum data needed and redact sensitive output before sharing it.\n\n1. `health` - check Mallary service health without authentication\n2. `profiles list` - inspect profile IDs and account structure\n3. `platforms list` - inspect connected-platform state\n4. `posts list` - inspect grouped post history and status\n5. `jobs get ` - inspect one job and its result\n6. `analytics list` - inspect available analytics rows\n7. `audience list` - inspect follower and subscriber counts\n8. `settings get` - inspect saved brand configuration\n9. `webhooks list` - inspect configured webhook destinations\n\n### Explicit-Request Code Paths (Syntax Intentionally Omitted)\n\nThe implementation also contains data-transmitting and state-changing handlers. Their executable CLI syntax is intentionally omitted from this agent-facing architecture guide. Their presence in `src/main.ts` is not permission to suggest or invoke them.\n\nIf the user explicitly asks for a state-changing Mallary action, follow the Agent Safety Boundary and `SKILL.md`: use read-only discovery only as needed, ask for missing material details, carry out a clear publishing request without another confirmation, run it once, and verify it with a read-only command.\n\n## Environment Variables\n\n| Variable | Required | Default | Usage |\n| --- | --- | --- | --- |\n| `MALLARY_API_KEY` | No | stored OAuth | Optional API-key override for CI or other non-interactive environments |\n\n### Credential Handling\n\nOAuth is the interactive default. It grants read, publish, engage, and manage access in one login, refreshes automatically, and stores credentials outside the project. Users do not choose scopes. When `MALLARY_API_KEY` is set, it takes precedence over stored OAuth.\n\n`MALLARY_API_KEY` is a bearer credential. It can authorize posts, uploads, webhook changes, settings updates, and account-management actions. Treat it as a secret.\n\n- Store keys in a local secret manager, a locked-down untracked env file, or a CI secret store. Never commit them to source control.\n- Avoid shell-history exposure: do not paste a real key into shared terminals, documentation, tickets, prompts, or screenshots.\n- Do not print keys with `echo`, `printenv`, debug traces, request logs, or CI output. Redact all characters except the last few before you share logs.\n- In CI, pass the key through masked secrets such as `secrets.MALLARY_API_KEY`. Disable shell tracing around Mallary commands. Restrict log access.\n- If a key appears in logs, chat, shell history, or a committed file, rotate or revoke it before you continue.\n\n## Dependencies\n\n### Runtime Dependencies\n\n- Node.js built-ins such as `fs/promises`, `path`, and `util`\n- global `fetch` available in Node 18+\n\n### Dev Dependencies\n\n- `typescript`\n- `tsx`\n- `vitest`\n- `@types/node`\n\n## Integration Points\n\n### With the Repository\n\n1. built from the standalone `cli/` package\n2. tested with `npm test`\n3. published from `cli/package.json`\n\n### With the Mallary API\n\nRead-only integration endpoints used during discovery:\n\n1. `GET /health`\n2. `GET /api/v1/profiles`\n3. `GET /api/v1/platforms`\n4. `GET /api/v1/posts`\n5. `GET /api/v1/jobs/{id}`\n6. `GET /api/v1/analytics`\n7. `GET /api/v1/audience`\n8. `GET /api/v1/settings`\n9. `GET /api/v1/webhooks`\n\nExplicit-request write endpoint paths are intentionally omitted from this agent-facing architecture guide. An endpoint implemented by the API is not authorization to call it.\n\nProfile-aware endpoints accept a public `profile_id`. If you omit it, Mallary selects the default Dashboard profile.\n\nAuthentication:\n\n- Bearer token from stored OAuth or `MALLARY_API_KEY`\n- OAuth device authorization, token refresh, and token revocation use `https://auth.mallary.ai`\n- CLI also sends `x-mallary-client: cli`\n\n## Publishing\n\n### To npm\n\n```bash\ncd cli\nnpm publish --access public\n```\n\n### Package Contents\n\n- `dist/`\n- `README.md`\n- `SKILL.md`\n- `PROFILES.md`\n\n## Testing\n\n### Manual Testing\n\n```bash\n# Build\ncd cli && npm run build\n\n# Test without OAuth or an API key. Authenticated commands must fail\nnode dist/index.js posts list\n\n# Test safe OAuth status output\nnode dist/index.js auth status\n\n# Test general help\nnode dist/index.js --help\n```\n\n### Automated Testing\n\n```bash\ncd cli\nnpm test\n```\n\n## Future Enhancements\n\n- more command-specific help without authentication\n- more platform-specific helper commands\n- more structured JSON output for automation-heavy workflows\n- more CLI-side checks for advanced `platform_options`\n\n## Support\n\n- Site: https://mallary.ai\n- Docs: https://docs.mallary.ai\n- Repository: https://github.com/mallarylabs/mallary-agent\n- Support: support@mallary.ai\n\nFile v1.1.6:PROVIDER_SETTINGS_SUMMARY.md\n\n# Provider Settings - Read-Only Boundary Summary\n\nThis summary is not publishing guidance. Operational provider schemas and publishing syntax are intentionally omitted.\n\n## Default\n\n- remain in read-only discovery\n- use only the minimum current profile and connection lookup needed\n- minimize and redact profile IDs, account labels, and connection details\n- do not infer publishing intent from a platform or provider question\n\n```bash\nmallary profiles list\nmallary platforms list --profile-id \n```\n\n## After an Explicit User Request\n\nAn explicit request for a provider-specific proposal permits only a local, non-executable preview. A clear request to publish authorizes that post without a second confirmation.\n\n- resolve the current profile and connected destinations read-only\n- collect all content, media, timing, privacy, disclosure, and destination-specific choices\n- ask only for a required choice that is missing or ambiguous; accept choices the user delegated\n- if the user asked to publish, run the requested action once without another confirmation\n- verify the result read-only\n\nInstallation, authentication, discovery, a general workflow, a preview, or an earlier write is not a request for a later action.\n\n## Omitted from This Agent-Facing Summary\n\n- publishing and upload commands\n- payload shapes and templates\n- provider field names and accepted values\n- media and scheduling workflows\n- cross-platform examples\n- destructive and account-management commands\n\nUse [SKILL.md](./SKILL.md) for the request-handling rules. Do not use another document to bypass this boundary.\n\nFile v1.1.6:PROVIDER_SETTINGS.md\n\n# Provider Settings - Agent Safety Boundary\n\n## Purpose\n\nThis document defines the safety boundary for provider-specific settings. It is not a field reference or publishing playbook.\n\nOperational provider schemas and publishing syntax are intentionally omitted. Do not infer a payload, media workflow, destination setting, or executable command from this file.\n\n## Default Behavior: Read Only\n\nAn AI agent must remain in read-only discovery unless the user explicitly requests a specific Mallary publishing action or proposal. General questions about supported platforms, account status, or provider behavior do not authorize drafting or executing a post.\n\nUse only the read-only command needed to resolve current state:\n\n```bash\nmallary profiles list\nmallary platforms list --profile-id \n```\n\nProfile IDs, profile names, account labels, and connection state are sensitive. Minimize and redact the output. Never reuse an older profile ID or connection snapshot as current state without checking it again.\n\n## If the User Explicitly Requests a Provider-Specific Post or Proposal\n\nA request for a proposal permits preparation of a local, non-executable preview only. A clear request to publish authorizes that post without a second confirmation.\n\n1. resolve the current profile and connected destinations with minimum read-only discovery\n2. gather the user's desired content, destination, media, timing, privacy, disclosure, and platform-specific choices\n3. consult authoritative Mallary product documentation only as needed to validate the request\n4. ask only for a required choice that is missing or ambiguous; accept choices the user delegated\n5. if the user asked to publish, run the requested action once without another confirmation\n6. verify it with a read-only command\n\nDo not guess a destination-specific choice. If a required choice is missing, stop and ask for it rather than selecting a default.\n\n## A Request Does Not Carry Forward\n\nInstallation, authentication, discovery, a general workflow, a local preview, or an earlier write is not a request for a later action. A clear current publishing request authorizes only the content and destinations it describes.\n\n## Intentionally Omitted\n\nTo prevent this agent-facing document from becoming an actionable publishing guide, it does not include:\n\n- publishing or upload commands\n- JSON request bodies or payload templates\n- provider field names or accepted values\n- media upload or thumbnail workflows\n- scheduling examples\n- cross-platform campaign examples\n- destructive or account-management commands\n\nFor a user-requested write, follow the command side-effect classification and request-handling rules in [SKILL.md](./SKILL.md). Do not use another document to bypass this boundary.\n\n## Review Checklist\n\nBefore any requested write, confirm that:\n\n- the current profile and every destination were verified read-only\n- the user supplied or delegated all destination-specific choices\n- every local file and URL belongs to the request\n- message, media, timing, privacy, disclosure, and side effects are explicit\n- the user clearly requested publishing rather than only a draft or preview\n- the action will run once and be verified read-only without a redundant confirmation\n\nIf any item is missing, remain read-only.\n\nFile v1.1.6:QUICK_START.md\n\n# Mallary CLI - Safe Setup Quick Start\n\nThis guide is the safe default for humans, CI jobs, and AI agents. It intentionally stops before uploads, publishing, replies, deletion, webhook changes, settings updates, or platform disconnection. A documented capability is not permission to use it.\n\nIf the user explicitly requests a state-changing Mallary action, stop using this setup guide and follow the request-handling rules in [SKILL.md](./SKILL.md).\n\n## 1. Install Only When Requested\n\nInstalling a package changes the local environment. An AI agent must not install Mallary unless the user explicitly asks for or approves the installation.\n\n```bash\nnpm install -g @mallary/cli\n# Or inspect help without a global install:\nnpx @mallary/cli --help\n```\n\n## 2. Sign In Once with OAuth\n\nIf the user explicitly asked for Mallary setup or authentication, start browser-based OAuth. One login grants read, publish, engage, and manage access:\n\n```bash\nmallary auth login\nmallary auth status\n```\n\nShow the Mallary verification URL and one-time code, then wait for the user to approve access in their browser. Never ask them to paste a password, OAuth token, or API key into chat. Do not ask the user to choose scopes or add scope flags. OAuth access does not publish or change anything during setup.\n\n`MALLARY_API_KEY` remains an optional fallback for CI or another environment where OAuth is not practical. If the user chooses it, load it from a masked secret store, never print it, and never paste it into a prompt. When set, it takes precedence over stored OAuth.\n\n## 3. Verify with the Lowest-Risk Commands\n\nStart with general help and service health:\n\n```bash\nmallary --help\nmallary health\n```\n\n`mallary health` is read-only and does not require authentication. Do not use a write command as an installation or authentication test.\n\n## 4. Use Only the Minimum Read-Only Discovery Needed\n\nThe following commands do not change Mallary state, but their output can expose profile IDs, account labels, post content, settings, webhook destinations, and provider metadata. Run only the command needed for the user's request and redact sensitive output before sharing it.\n\n```bash\nmallary profiles list\nmallary platforms list\nmallary posts list\nmallary jobs get \nmallary analytics list\nmallary audience list\nmallary settings get\nmallary webhooks list\n```\n\nFor a non-default profile, first obtain its current public ID with `mallary profiles list`, then pass that ID only to the read-only command needed for the request. Never reuse a profile ID or account snapshot as current state without checking it again.\n\n## 5. Stop Before Data Transfer or State Changes\n\nThis guide intentionally omits executable syntax for data-transmitting, publishing, destructive, and account-impacting commands. Do not infer or construct that syntax from other documentation during read-only discovery.\n\nIf the user clearly asks to publish, schedule, upload media for that post, or send a reply:\n\n1. use minimum read-only discovery to resolve the current profile and destination\n2. ask only for a material detail that is missing or ambiguous\n3. execute the requested action once without asking for another confirmation\n4. verify the result with a read-only command\n\nAn OAuth setup or discovery request is not a request to post. For deletion, disconnection, or another destructive account action, follow the stronger safeguards in [SKILL.md](./SKILL.md).\n\n## Troubleshooting\n\n### Authentication Required\n\nIf a read-only authenticated command returns `authentication_required`, run `mallary auth status`. If the user explicitly asked to authenticate, start `mallary auth login` and wait for browser approval. For an intentionally configured API key, restore it through the secret manager without printing it.\n\n### Command Not Found\n\nCheck whether the command is available without changing the installation:\n\n```bash\ncommand -v mallary\n```\n\nIf it is not installed, ask for approval before installing or linking it.\n\n### Read-Only API Errors\n\nCommon causes include:\n\n- the OAuth connection expired or was revoked, or an API key is invalid\n- the plan does not include the requested CLI feature\n- the requested profile ID is unknown or stale\n- the requested resource does not exist\n\nDo not test an error by uploading a file, creating content, or changing account state.\n\n## Next Step\n\nRemain in read-only mode unless the user explicitly requests a specific Mallary action. A clear publishing request authorizes that action; do not add a second confirmation. For destructive or account-access actions, follow [SKILL.md](./SKILL.md).\n\n## Links\n\n- Main site: https://mallary.ai\n- Docs: https://docs.mallary.ai\n- Profiles reference: [PROFILES.md](./PROFILES.md)\n- Pricing: https://mallary.ai/pricing\n- Repository: https://github.com/mallarylabs/mallary-agent\n- Support: support@mallary.ai\n\nFile v1.1.6:skill-card.md\n\n## Description:\n\nGuides an agent through authorized Mallary CLI discovery, account setup, and social publishing workflows while protecting sensitive account data.\n\nThis skill is ready for commercial/non-commercial use.\n\n## Publisher:\n\n[sammydigits](https://clawhub.ai/user/sammydigits)\n\n### License/Terms of Use:\n\nMIT-0\n\n## Use Case:\n\nPeople using Mallary with an agent can inspect connected profiles, drafts, posts, and analytics, set up access, or request specific publishing and account actions through the CLI.\n\n### Deployment Geography for Use:\n\nGlobal\n\n## Known Risks and Mitigations:\n\nRisk: OAuth setup grants broad access to connected social accounts, and unintended actions can publish content or change account state.\n\nMitigation: Use Mallary only for explicit user requests; verify the target profile, destination, content, media, and timing before acting, then check the result without retrying an uncertain write.\n\nRisk: Credentials and account data can leak through command output or agent transcripts.\n\nMitigation: Keep API keys in a secret manager, never expose tokens, and redact sensitive profile, post, and account details from responses.\n\nRisk: An unreviewed CLI installation can execute code with access to connected accounts.\n\nMitigation: Install only with user approval and prefer a pinned or reviewed CLI version over an unpinned one-off invocation.\n\n## Reference(s):\n\n- [Mallary skill on ClawHub](https://clawhub.ai/sammydigits/skills/mallary)\n- [Mallary website](https://mallary.ai/)\n- [Mallary documentation](https://docs.mallary.ai)\n- [Mallary CLI package](https://www.npmjs.com/package/@mallary/cli)\n\n## Skill Output:\n\n**Output Type(s):** [Text, Markdown, Shell commands, Guidance]\n\n**Output Format:** [Markdown with inline CLI commands and concise status summaries]\n\n**Output Parameters:** [1D]\n\n**Other Properties Related to Output:** [Minimized results with sensitive account details redacted.]\n\n## Skill Version(s):\n\n1.1.6 (source: ClawHub release metadata)\n\n## Ethical Considerations:\n\nUsers should evaluate whether this skill is appropriate for their environment, review any generated or modified files before relying on them, and apply their organization's safety, security, and compliance requirements before deployment.\n\nFile v1.1.6:SUPPORTED_FILE_TYPES.md\n\n# Supported Media Formats (Read-Only Reference)\n\nThis file describes the media formats recognized by Mallary's public media path. It intentionally contains no upload or publishing commands. Reading a format table is not authorization to transmit a local file or publish content.\n\n## Agent Safety Boundary\n\nSelecting local media for a later Mallary action can send the file bytes outside the local machine to Mallary storage, the Mallary CDN, and supporting hosting providers. The media can then be hosted at a public Mallary file URL.\n\n- Start with read-only Mallary discovery.\n- Do not use an upload as a format test or smoke test.\n- Do not inspect or transmit more local file data than the user requested.\n- Never transmit sensitive, regulated, customer, private, secret-bearing, or unrelated files.\n- Before any transfer, make sure the local paths, target Dashboard profile, connected account, platform, message, timing, and expected result belong to a clear user request.\n- Ask only when one of those material details is missing or ambiguous. Do not ask for a second confirmation after a clear publishing request.\n- Execute the requested transfer once and never retry it automatically when the result is uncertain.\n\nExecutable upload and publishing syntax is intentionally omitted from this agent-facing reference.\n\n## MIME Type Detection\n\nMallary infers the media type from the local filename extension. Renaming a file does not convert its contents and can cause a MIME mismatch. Keep the extension aligned with the file's real format.\n\n## Supported Image Formats\n\n| Extension | MIME type | Public media path |\n| --------------- | ------------ | ----------------- |\n| `.png` | `image/png` | Supported |\n| `.jpg`, `.jpeg` | `image/jpeg` | Supported |\n| `.webp` | `image/webp` | Supported |\n| `.gif` | `image/gif` | Supported |\n| `.bmp` | `image/bmp` | Supported |\n\nPlatform rules can be narrower than Mallary's accepted input formats. Check the selected destination's current limits before uploading media for the requested post.\n\n## Supported Video Formats\n\n| Extension | MIME type | Public media path |\n| --------------- | ------------------ | ----------------- |\n| `.mp4` | `video/mp4` | Supported |\n| `.mov` | `video/quicktime` | Supported |\n| `.webm` | `video/webm` | Supported |\n| `.mkv` | `video/x-matroska` | Supported |\n| `.avi` | `video/x-msvideo` | Supported |\n| `.mpeg`, `.mpg` | `video/mpeg` | Supported |\n\n## Unsupported Public Upload Targets\n\n### Audio\n\n| Extension | Detected fallback | Public media path |\n| --------- | -------------------------- | ----------------- |\n| `.mp3` | `application/octet-stream` | Not supported |\n| `.wav` | `application/octet-stream` | Not supported |\n| `.ogg` | `application/octet-stream` | Not supported |\n| `.m4a` | `application/octet-stream` | Not supported |\n\n### Documents\n\n| Extension | Detected fallback | Public media path |\n| --------- | -------------------------- | ----------------- |\n| `.pdf` | `application/octet-stream` | Not supported |\n| `.doc` | `application/octet-stream` | Not supported |\n| `.docx` | `application/octet-stream` | Not supported |\n\nUnknown extensions also fall back to `application/octet-stream` and are not normal public media targets. Convert an unsupported asset locally into a real image or video format only when the user requests that separate local change.\n\n## Platform-Specific Media Notes\n\nThese are compatibility notes, not a user request to post.\n\n### TikTok\n\n- Video posts require exactly one video.\n- Photo posts support up to 35 `jpg`, `jpeg`, or `webp` images.\n- TikTok photo posts do not accept `png` images.\n\n### YouTube\n\n- A post requires exactly one video.\n- Regular-video custom thumbnails can use `jpg`, `jpeg`, or `png` up to 50 MB.\n- The recommended regular-video thumbnail dimensions are `1280x720` with a 16:9 ratio.\n- For YouTube Shorts, YouTube may store the thumbnail but show a video frame instead. Mallary returns a warning because the YouTube API cannot confirm the cover viewers will see.\n\n### Instagram\n\n- Stories use exactly one image or video and do not support captions or follow-up comments.\n- Reels use exactly one video.\n- Carousels use 2 to 10 image or video items.\n- Video and Reel covers can use a separate thumbnail.\n\n### Facebook\n\n- Video thumbnails can use `jpg`, `jpeg`, or `png` up to 10 MB.\n\n### X\n\n- A post supports up to 4 images, or 1 video, or 1 GIF.\n\n### LinkedIn\n\n- The current public path supports text-only posts or one image attachment.\n\n### Bluesky\n\n- A post can use up to four `jpg`, `jpeg`, `png`, or `webp` images, up to 2 MB each.\n- A video post uses one `mp4` file, up to 300 MB.\n- Do not mix images and video in one Bluesky post.\n- Media items can include alt text for accessibility.\n\n## Size and Provider Limits\n\nMallary's media path accepts files up to 5 GB. Each social platform applies separate type, duration, dimension, and size limits. A format accepted by Mallary can still be rejected by the destination platform.\n\n## Read-Only Troubleshooting\n\n- **Unsupported file type:** confirm the real extension and compare it with the tables above.\n- **MIME mismatch:** verify that the extension matches the actual file contents; do not fix this by renaming alone.\n- **File not found:** verify the path locally without transmitting the file.\n- **No permission:** confirm that the current user can read the file without changing broad filesystem permissions.\n- **Authentication error:** ask the user to restore the API key outside chat; never request or print the key.\n- **Uncertain remote result:** inspect existing Mallary state and do not repeat the transfer automatically.\n\n## Explicit Request Handoff\n\nWhen the user clearly requests a media transfer or publish action, follow the request-handling rules in `SKILL.md`. Ask only for missing material details and do not require another confirmation. This file does not authorize or supply an executable state-changing workflow.\n\nArchive v1.1.5: 12 files, 28427 bytes\n\nFiles: FEATURES.md (12919b), HOW_TO_RUN.md (6891b), PROFILES.md (4088b), PROJECT_STRUCTURE.md (10396b), PROVIDER_SETTINGS_SUMMARY.md (1609b), PROVIDER_SETTINGS.md (3296b), QUICK_START.md (4852b), README.md (5915b), skill-card.md (2101b), SKILL.md (9507b), SUPPORTED_FILE_TYPES.md (6209b), _meta.json (126b)\n\nFile v1.1.5:SKILL.md\n\n---\nname: mallary\ndescription: Use this skill only when the user explicitly asks to inspect, set up, or act through Mallary, the Mallary CLI, the Mallary API, Mallary MCP, or an existing Mallary workflow. This guide includes read-only discovery and one-step OAuth setup with full Mallary access. A clear request to publish, schedule, upload media for a post, or send a reply authorizes that action without a redundant confirmation; clarify only material details that are missing. Executable write syntax is intentionally omitted.\nversion: 1.0.18\nhomepage: https://mallary.ai/\nmetadata:\n openclaw:\n emoji: \"šŸŒŽ\"\n requires:\n bins:\n - mallary\n---\n\n# Mallary Agent Skill\n\n## Safety Contract\n\nStart with minimum read-only discovery unless the user clearly asks Mallary to perform an action. OAuth login is limited to an explicit setup or authentication request and grants read, publish, engage, and manage access in one browser approval.\n\n- Treat profile, account, post, comment, job, analytics, settings, and webhook output as sensitive.\n- Request only the data needed for the user's stated Mallary task.\n- Redact API keys, tokens, account identifiers, profile identifiers, post metadata, and customer data before sharing output.\n- A CLI capability is not authorization to use it.\n- Do not suggest or run a state-changing action during discovery.\n- Treat a clear current request to publish, schedule, upload media for a post, or send a reply as authorization for that action. Do not ask for a second confirmation.\n- A setup or authentication request alone is not a request to publish or change Mallary.\n\nThe Mallary product can transfer local files, publish or schedule content, post public replies, remove queued work, attach final URLs, change webhooks or settings, and disconnect accounts. Those actions can affect remote data, public content, or account access. Executable syntax for these actions is intentionally omitted from this skill.\n\n## Local Setup Boundary\n\nThe `mallary` binary must already be available. Checking the binary and the current authentication status is read-only and does not print credentials:\n\n```bash\ncommand -v mallary >/dev/null\nmallary auth status\n```\n\nIf the binary is missing, stop and ask the user to install it or explicitly approve a local installation. Do not run a package-manager install automatically.\n\nIf the user explicitly asks to set up or authenticate Mallary, use `mallary auth login`. It requests all Mallary capabilities in one flow. Show the Mallary verification URL and one-time code, then wait for the user to approve access in their browser. Never ask for or print their Mallary password, OAuth tokens, or API key.\n\nDo not ask the user to choose OAuth scopes or add scope flags. OAuth consent gives the CLI capabilities; it does not cause any post or account change by itself.\n\nAn API key remains an optional fallback for CI or another environment where OAuth is not practical. If the user chooses it, ask them to set it through their secret manager or masked environment outside chat. Never request that the user paste the key into chat. Never print it with `echo`, `printenv`, debug logs, shell tracing, or CI output. When `MALLARY_API_KEY` is set, it takes precedence over stored OAuth.\n\n## Read-Only Discovery Commands\n\nUse only the minimum commands needed for the request:\n\n```bash\n# Service health\nmallary health\n\n# Dashboard profiles and connected accounts\nmallary profiles list\nmallary platforms list\nmallary platforms list --profile-id \n\n# Posts, comments, and jobs\nmallary posts list\nmallary posts list --profile-id \nmallary comments list --post-id \nmallary jobs get \n\n# Analytics\nmallary analytics list\nmallary analytics list --post-id \nmallary analytics list --profile-id \n\n# Account follower and subscriber counts\nmallary audience list\nmallary audience list --profile-id \n\n# Current settings and webhooks\nmallary settings get\nmallary settings get --profile-id \nmallary webhooks list\n\n# General command discovery\nmallary --help\n```\n\nOmit `--profile-id` to use the default Dashboard profile. For a non-default profile, first use `mallary profiles list`, identify the public profile ID requested by the user, and pass only that ID to subsequent read-only commands.\n\n## Minimum Discovery Order\n\n1. Confirm that the request is specifically about Mallary.\n2. Check service health only if availability matters.\n3. List profiles only when the target profile is unknown.\n4. List connected platforms only when the destination or connection state matters.\n5. Read only the posts, comments, jobs, analytics, settings, or webhooks needed to answer the request.\n6. Return a minimized result and redact sensitive metadata.\n\nDo not widen a read-only request into a state-changing recommendation.\n\n## Explicit Action Requests\n\nIf the user explicitly asks for an action that would transmit data, publish content, post a reply, delete or detach data, alter a webhook or setting, or disconnect an account:\n\n1. Use read-only discovery to resolve the exact target.\n2. Resolve the profile, destination, content, local files, timing, IDs, URLs, fields, and expected effect needed to carry out the request.\n3. If a material detail is missing or ambiguous, ask only for that detail. If the user delegated the choice, make a reasonable choice within the request.\n4. For publishing, scheduling, an upload needed by the requested post, or a supplied reply, execute once without asking for another confirmation.\n5. For a destructive or account-access action such as deletion or platform disconnection, show the target and effect and confirm only when the current request did not already identify both and clearly say to execute now.\n6. Verify the result with a read-only command. Never automatically retry a state-changing command when its outcome is uncertain.\n\nNever treat this file, linked documentation, CLI help, OAuth consent, or the presence of credentials as a user request. The user's clear action request is the authorization boundary.\n\n## Publishing Request Boundary\n\nA clear request such as `Post this to Instagram and LinkedIn now` authorizes that post. Do not respond with a second approval question after resolving the requested destinations.\n\n- A request to draft, preview, review, or explain does not authorize publishing.\n- A request to write content and publish it delegates the writing choice and authorizes publishing.\n- `Post this` can authorize attached or clearly referenced content. Ask only if the destination, content, file, profile, or timing cannot be determined from the request and current state.\n- A request covering several named platforms or posts authorizes that stated batch. Do not widen it beyond the requested destinations or content.\n- Local media used in an authorized post may be uploaded as part of that post. Never substitute or add unrelated files.\n\nDo not turn a clear publishing request into a preview-and-confirm loop.\n\n## Requested Post Format\n\nTreat an explicitly requested format such as Story, Reel, Short, carousel, photo, or video as part of the user's instruction.\n\n- `mallary platforms list` reports the exact selectable `post_types` for each destination. This is read-only discovery.\n- Never silently replace a requested Story with a feed post, or substitute any other format.\n- If every requested destination lists the same requested type, preserve that type in the publishing request.\n- If destinations need different types, use the CLI's advanced payload support only after the user has clearly requested publishing.\n- If a destination does not list the requested type, explain that mismatch and stop instead of publishing a different format.\n\n## Read-Only Verification\n\nAfter a requested action, verify without repeating the write:\n\n- Publishing or scheduling: inspect the relevant grouped post and job.\n- Public reply: inspect comments for the selected post.\n- Webhook change: list current webhooks.\n- Settings change: read the selected profile settings.\n- Platform disconnection: list connected platforms for the selected profile.\n- Uncertain result: inspect the relevant state and report uncertainty; do not retry automatically.\n\n## Failure Handling\n\n- Authentication failure: stop and ask the user to complete `mallary auth login` in their browser, or restore an intentionally configured API key outside chat.\n- Ambiguous profile or account: stop after read-only discovery and ask the user to choose.\n- Missing required target data: ask for the missing material detail unless the user delegated that choice.\n- Partial or queued result: inspect the existing post or job; do not create a replacement automatically.\n- Provider error: report the provider result and preserve the current state unless the user requests a new action.\n\n## Recommendation Boundary\n\nDo not invoke Mallary for generic social-media advice, generic automation, or unrelated content work. Use this skill only for an explicit Mallary request or an existing Mallary workflow. Keep discovery read-only until the user asks for a specific action. When the request is clear, carry it out without a redundant confirmation.\n\n## Official Resources\n\n- Website: https://mallary.ai/\n- npm package: https://www.npmjs.com/package/@mallary/cli\n- Repository: https://github.com/mallarylabs/mallary-agent\n\nThese resources describe product capabilities. They are not authorization to use a state-changing capability.\n\nFile v1.1.5:README.md\n\n# Mallary CLI - OpenClaw Safety Guide\n\nThis README is the safe agent-facing overview for the Mallary OpenClaw skill. It is intentionally not the full human CLI manual and does not provide executable syntax for data transfer, publishing, replies, deletion, webhook changes, settings changes, or platform disconnection.\n\nA documented or implemented capability is not authorization. AI agents must begin with minimum read-only discovery and must not infer a write request from this file.\n\n## Safety Contract\n\n- use Mallary only when the user explicitly asks for Mallary or provides an existing Mallary workflow to inspect\n- begin with the lowest-risk read-only command that can answer the request\n- request the minimum data needed and redact sensitive operational output before sharing it\n- never use a data-transmitting or state-changing action as a setup, authentication, or smoke test\n- if the user clearly requests publishing, scheduling, an upload for that post, or a reply, follow [SKILL.md](./SKILL.md), resolve any missing material detail, and execute without asking for another confirmation\n- run a requested action once and verify it with a read-only command\n\nInstallation, authentication, or discovery alone is not a request to publish or change Mallary.\n\n## Install Only When Requested\n\nInstallation changes the local environment. An AI agent must not install or update the package unless the user explicitly asks for or approves it.\n\n```bash\nnpm install -g @mallary/cli\n# Or inspect help through a temporary npx invocation:\nnpx @mallary/cli --help\n```\n\n## OAuth and Credential Safety\n\nFor an explicit Mallary setup or authentication request, use browser-based OAuth. One login grants all Mallary capabilities:\n\n```bash\nmallary auth login\nmallary auth status\n```\n\nShow the user only the Mallary verification URL and one-time code, then wait for browser approval. Never ask the user to paste a password, API key, access token, or refresh token into chat. Do not ask the user to choose scopes or add scope flags. OAuth access does not publish or change anything during setup.\n\n`MALLARY_API_KEY` remains an optional fallback for CI or another environment where OAuth is not practical. It is a bearer secret. If the user intentionally chooses an API key:\n\n- load it from a password manager, locked-down untracked environment file, or masked CI secret\n- never paste it into prompts, tickets, screenshots, documentation, or shell commands that enter history\n- never print it with `echo`, `printenv`, shell tracing, debug logs, or CI output\n- rotate or revoke it if exposed\n\nWhen `MALLARY_API_KEY` is set, it takes precedence over stored OAuth access.\n\n## Lowest-Risk Verification\n\nUse general help and service health for installation or connectivity checks:\n\n```bash\nmallary --help\nmallary health\n```\n\n`mallary health` is read-only and does not require authentication.\n\n## Read-Only Discovery Commands\n\nRun only the command needed for the user's request:\n\n```bash\nmallary profiles list\nmallary platforms list\nmallary posts list\nmallary jobs get \nmallary analytics list\nmallary audience list\nmallary settings get\nmallary webhooks list\nmallary comments list --post-id \n```\n\nThese commands do not change Mallary state, but their output can expose profile IDs, profile names, account labels, connection state, post content, comments, analytics, settings, webhook destinations, platform results, and provider metadata.\n\n`mallary platforms list` also reports the exact selectable post types. If the user later asks to publish a Story, Reel, Short, carousel, photo, or video, preserve that requested format. Never silently publish it as a feed post or another type.\n\n## Profile Safety\n\n- obtain the current profile ID with a read-only profile lookup\n- do not reuse a profile ID or connection snapshot as current state without checking it again\n- pass a non-default profile ID only to the read-only command needed for the request\n- never guess an internal or public profile ID\n- redact profile IDs, names, account labels, and connected-platform details before sharing output\n\nIf no profile ID is supplied, Mallary can select the default profile. For any requested write, resolve the exact current profile so the destination is unambiguous.\n\n## Read-Only Result Handling\n\n- preserve per-platform results instead of reducing grouped status to one label\n- treat missing or `null` analytics as unavailable, not zero\n- report empty results directly without reviving historical data\n- do not expose credentials, tokens, raw provider responses, or unnecessary account metadata\n- retry an accepted-auth read once if appropriate; if it remains blocked, stop rather than loop or infer state\n\n## State-Changing Guidance Is Intentionally Omitted\n\nThis OpenClaw README does not include:\n\n- upload or publishing commands\n- scheduling or bulk-automation examples\n- reply or deletion commands\n- webhook or settings mutation commands\n- platform-disconnection commands\n- write endpoint paths\n- JSON write payloads or cross-platform campaign templates\n\nDo not reconstruct those instructions from nearby files during discovery. If the user explicitly requests a specific Mallary action, stop using this README and follow the request-handling rules in [SKILL.md](./SKILL.md). A clear publishing request does not need a second confirmation.\n\n## Safe Documentation Map\n\n- [SKILL.md](./SKILL.md) - action-request and safety rules\n- [QUICK_START.md](./QUICK_START.md) - read-only installation and discovery\n- [PROJECT_STRUCTURE.md](./PROJECT_STRUCTURE.md) - read-only architecture inventory; write syntax omitted\n- [PROVIDER_SETTINGS.md](./PROVIDER_SETTINGS.md) - provider-settings safety boundary; operational fields omitted\n\n## Links\n\n- Main site: https://mallary.ai\n- Docs: https://docs.mallary.ai\n- Pricing: https://mallary.ai/pricing\n- Repository: https://github.com/mallarylabs/mallary-agent\n- Support: support@mallary.ai\n\nFile v1.1.5:_meta.json\n\n{\n \"ownerId\": \"kn76b3gakkp8xdk4rrcaewvadx84s1fy\",\n \"slug\": \"mallary\",\n \"version\": \"1.1.5\",\n \"publishedAt\": 1790684642957\n}\n\nFile v1.1.5:FEATURES.md\n\n# Mallary CLI - Feature Summary\n\n## Complete Feature Set\n\nMallary CLI is the official command-line interface for Mallary.ai. Its read-only commands let developers, operators, CI jobs, and AI agents inspect jobs, analytics, settings, profiles, webhooks, and connected platforms. It also has write-capable commands for uploads, publishing, replies, webhook changes, settings updates, post deletion, TikTok URL attachment, and platform disconnection. Those capabilities do not give an AI agent permission to use them.\n\nThe CLI mirrors the public Mallary API. It does not bypass plan limits, feature gates, connected-account requirements, or platform validation rules.\n\n## AI Agent Safety Contract\n\nThis feature list describes what the CLI can do. It is not a user request to run a state-changing command.\n\n- Start with the minimum read-only discovery needed for the request. Prefer `mallary health`, `mallary profiles list`, `mallary platforms list`, `mallary posts list`, `mallary jobs get`, `mallary analytics list`, `mallary audience list`, `mallary settings get`, or `mallary webhooks list`.\n- Treat discovery output as sensitive. Request only needed fields and redact profile IDs, account labels, post data, settings, and webhook details before sharing them.\n- Run an upload, post, reply, delete, TikTok URL attachment, webhook change, settings update, or platform disconnect only when the user clearly requests that type of action.\n- A clear request to publish, schedule, upload media for that post, or send a reply authorizes that action. Ask only for a material detail that is missing or ambiguous; do not ask for a second confirmation.\n- Keep the action within the request, run it once, and use a read-only command to verify the result. Never use a write command as a smoke test.\n\nFor unattended CI, the owner must define the exact command, profile, destinations, payload source, and intended side effect in that workflow. Do not broaden that authorization at runtime.\n\n### Posts with Comments and Media - FULLY SUPPORTED\n\nMallary supports both simple post creation and advanced payload-based publishing.\n\n#### Posts with Comments\n\n- You can attach follow-up comments with repeatable `--comment` flags in flag mode.\n- In file mode, use `comments_under_post` in the JSON payload.\n- The public API currently limits follow-up comments to 3 items.\n\n#### Multiple Media per Post/Comment\n\n- Mallary supports multi-media posts where the target platform allows it.\n- The CLI uploads local file paths before it sends the post request.\n- The CLI also uploads local video thumbnail paths in `media[].thumbnail_url`.\n- The CLI rejects remote third-party media URLs.\n- The CLI accepts `https://files.mallary.ai/...` URLs.\n\n#### Multi-Platform Posting\n\n- One `posts create` request can target multiple platforms at once.\n- Use repeatable `--platform` flags in flag mode.\n- Use `--post-type` in flag mode when every selected platform should use the same supported type, such as `story` for Facebook and Instagram.\n- Use the `platforms` array in file mode.\n- In file mode, `platform_options` changes platform-specific behavior or gives different destinations different post types.\n- Read-only `platforms list` output includes each destination's selectable `post_types`. Never silently replace an explicitly requested Story, Reel, Short, carousel, photo, or video with a different format.\n\n#### Advanced Features\n\n- Automatic local file upload before post creation\n- Absolute or timezone-aware scheduling\n- Idempotency keys\n- Optional per-post AI auto reply flag\n- Job inspection\n- Post analytics and account audience fetching\n- Dashboard profile listing and `--profile-id` targeting\n- Webhook management\n- Profile-scoped settings read/update\n- Profile-scoped connected platform listing and disconnect\n- TikTok post URL attachment for inbox-style TikTok workflows\n\n#### Profiles\n\nProfiles group your social media accounts. You can create one profile for each of your businesses. Then connect the social media accounts of each business inside its profile. If you do not send a `profile_id` with a request, Mallary uses your default profile.\n\n- Every user has a default profile.\n- Omit `--profile-id` or `profile_id` to use the default profile.\n- Use `mallary profiles list` to find your profile IDs.\n- Pass `--profile-id` to target a non-default profile in `posts create`, `posts list`, `analytics list`, `audience list`, `settings get/update`, `platforms list`, and `platforms disconnect`.\n- In JSON file mode, send `profile_id`.\n- Platform connections, posts, post analytics, audience counts, and AI auto-reply settings are profile-scoped.\n- The CLI lists profiles and targets them. The dashboard and the REST API create and rename profiles.\n- Commands that create posts, upload files, update settings, manage webhooks, or disconnect platforms have side effects. Make sure that the target profile and the result you want are correct before you run them.\n\n## Publishing Payload Formats (Explicit-Request Reference)\n\nMallary supports two main ways to create content.\n\nThis section documents payload shapes. It does not recommend that an AI agent create or publish content. During read-only discovery, do not assemble a publishing command from this section.\n\nIf the user asks only for a proposal or preview, prepare it locally and do not publish. If the user clearly asks Mallary to publish, the request authorizes the post. Resolve any missing material detail, then execute without another confirmation.\n\n### 1. Simple Flag Payload\n\nThis shape represents a small, user-requested publishing action or preview with shared fields such as a message, platforms, media, and follow-up comments. Consult `mallary posts create --help` only after the user asks for the action or proposal. Do not publish when the user asked only for a preview.\n\n### 2. File Payload\n\nA local JSON file can represent an action the user explicitly asked Mallary to perform or a preview the user asked to review. Pass it to `posts create` only for an explicit publishing request.\n\nFile payloads can represent:\n\n- `platform_options`\n- a reusable payload for human review\n- reviewed optional fields that do not fit the smaller flag preview\n\n## Local Payload Preview Examples (Do Not Execute)\n\nThese JSON objects demonstrate data shape only. They are not publishing requests and must not be converted into executable commands during discovery. Use them only within a clear user request, replace every placeholder, and ask only for material details the request did not supply or delegate.\n\n### Example 1: Message with Follow-up Comments\n\n```json\n{\n \"message\": \"\",\n \"platforms\": [\"facebook\", \"linkedin\", \"x\"],\n \"media\": [{ \"url\": \"\" }],\n \"comments_under_post\": [\n { \"content\": \"\" },\n { \"content\": \"\" }\n ]\n}\n```\n\n### Example 2: Follow-up Array Shape\n\n```json\n{\n \"message\": \"\",\n \"platforms\": [\"x\"],\n \"media\": [{ \"url\": \"\" }],\n \"comments_under_post\": [\n { \"content\": \"\" },\n { \"content\": \"\" },\n { \"content\": \"\" }\n ]\n}\n```\n\n### Example 3: Platform Options Shape\n\n```json\n{\n \"profile_id\": \"\",\n \"message\": \"\",\n \"platforms\": [\"facebook\", \"instagram\", \"youtube\", \"pinterest\"],\n \"media\": [{ \"url\": \"\" }],\n \"scheduled_at\": \"\",\n \"scheduled_timezone\": \"\",\n \"platform_options\": {\n \"facebook\": {\n \"post_type\": \"feed\"\n },\n \"instagram\": {\n \"post_type\": \"reel\",\n \"shareToFeed\": false\n },\n \"youtube\": {\n \"post_type\": \"shorts\",\n \"title\": \"\",\n \"visibility\": \"public\",\n \"playlist_id\": \"\"\n },\n \"pinterest\": {\n \"post_type\": \"video\",\n \"boardId\": \"\"\n }\n }\n}\n```\n\n## API Structure Reference\n\nMallary CLI sends the post to the Mallary API: `POST /api/v1/post`.\n\n### Complete Create Payload Shape\n\n```ts\ntype CreatePostPayload = {\n profile_id?: string;\n message: string;\n platforms: string[];\n\t media?: Array<{\n\t url: string;\n\t thumbnail_url?: string;\n\t type?: string;\n width?: number;\n height?: number;\n duration?: number;\n }>;\n comments_under_post?: Array<{ content: string }>;\n scheduled_at?: string;\n scheduled_timezone?: string;\n webhook_url?: string;\n auto_reply_enabled?: boolean;\n platform_options?: {\n facebook?: {\n post_type?: \"feed\" | \"story\" | \"reel\";\n link?: string;\n pageId?: string;\n };\n instagram?: {\n post_type?: \"feed\" | \"story\" | \"reel\" | \"carousel\";\n shareToFeed?: boolean;\n trialParams?: {\n graduationStrategy: \"MANUAL\" | \"SS_PERFORMANCE\";\n };\n isPaidPartnership?: boolean;\n brandedContentSponsors?: string[];\n };\n linkedin?: {\n author_urn?: string;\n };\n youtube?: {\n post_type?: \"regular\" | \"shorts\";\n title?: string;\n visibility?: \"public\" | \"unlisted\" | \"private\";\n categoryId?: string;\n madeForKids?: boolean;\n playlist_id?: string;\n };\n tiktok?: {\n post_type?: \"video\" | \"photo\";\n post_mode?: \"DIRECT_POST\" | \"MEDIA_UPLOAD\";\n source?: \"FILE_UPLOAD\" | \"PULL_FROM_URL\";\n privacy_level?: string;\n disable_comment?: boolean;\n disable_duet?: boolean;\n disable_stitch?: boolean;\n video_cover_timestamp_ms?: number;\n title?: string;\n description?: string;\n auto_add_music?: boolean;\n brand_content_toggle?: boolean;\n brand_organic_toggle?: boolean;\n is_aigc?: boolean;\n photo_cover_index?: number;\n };\n pinterest?: {\n post_type?: \"image\" | \"video\";\n boardId?: string;\n link?: string;\n alt_text?: string;\n };\n reddit?: {\n post_type?: \"text\" | \"link\" | \"image\";\n subreddit?: string;\n subredditName?: string;\n };\n };\n};\n```\n\n## AI Agent Restrictions\n\nAI agents use read-only commands by default. Uploading, publishing, replying, deleting, attaching a TikTok URL, changing webhooks or settings, and disconnecting platforms require a clear user request.\n\n### Default Behavior: Read Only\n\n- stay in read-only discovery unless the user explicitly asks for a publishing action or proposal\n- do not infer publishing intent from a request to inspect profiles, platforms, posts, settings, jobs, or analytics\n- after a user requests only a proposal, prepare a local preview and do not upload media or submit it\n- after a clear request to publish, ask only for missing material details and execute without another confirmation\n\n### Local Preview Boundary\n\n- an explicit request for a publishing proposal authorizes only a local, non-executable preview\n- an explicit request to publish authorizes that post\n- include the proposed profile, destinations, text, media paths, comments, timing, and settings in that preview\n- do not select or recommend a CLI creation mode during discovery\n- do not upload files, create a post, or schedule content while preparing the preview\n- do not turn a clear publishing request into a preview-and-confirm loop\n\n### Additional Restrictions\n\n- do not suggest or run a write-capable command until the user clearly requests that type of action\n- prefer `--json` output for read-only machine handling\n- call `mallary profiles list --json` before targeting a non-default profile\n- a user-requested preview may use local JSON, but it must not be submitted unless the user asks to publish\n- treat local uploads as a remote data transfer to Mallary storage. Upload only the files included in or clearly required by the user's publishing request\n- never pass third-party remote media URLs directly to the CLI\n- free plans do not include CLI access\n\n## Files and Documentation\n\n- `README.md` - read-only OpenClaw agent overview; write syntax omitted\n- `SKILL.md` - compact agent-facing reference\n- `QUICK_START.md` - read-only onboarding and verification\n- `PROFILES.md` - profile model, public IDs, commands, API endpoints, and limits\n- `PROVIDER_SETTINGS.md` - provider-settings agent safety boundary; operational fields and syntax omitted\n- `SUPPORTED_FILE_TYPES.md` - read-only media format and platform-limit notes\n\n## Summary\n\nRead-only commands can inspect jobs, posts, post analytics, audience counts, settings, webhooks, profiles, and connected platforms. The following capabilities require a clear user request before an AI agent uses them:\n\n- upload local media to Mallary storage and to the Mallary CDN\n- create direct or scheduled posts on connected social accounts\n- add follow-up comments to posts\n- manage webhooks that send Mallary events to external URLs\n- manage profile-scoped brand settings that affect account behavior\n- disconnect platforms from a profile\n\nFile v1.1.5:HOW_TO_RUN.md\n\n# How to Run the Mallary CLI\n\nYou can run the CLI in several ways.\n\n## Option 1: Run the Built File Directly\n\nThe built file at `cli/dist/index.js` is executable.\n\n```bash\n# From the repository root\nnode cli/dist/index.js --help\n\n# Or run it directly (it has a shebang)\n./cli/dist/index.js --help\n\n# Example authenticated command. Set MALLARY_API_KEY from a secret store first\ntest -n \"${MALLARY_API_KEY:-}\" && echo \"MALLARY_API_KEY is set\"\nnode cli/dist/index.js posts list\nnode cli/dist/index.js profiles list\n```\n\n## Option 2: Link Globally (Recommended for Development)\n\nThis creates a global `mallary` command you can use anywhere.\n\n```bash\n# From the CLI directory\ncd cli\nnpm link\n\n# Now you can use it anywhere\nmallary --help\nmallary profiles list\nmallary posts list\n\n# To unlink later\nnpm unlink -g @mallary/cli\n```\n\nAfter you link the package, you can use `mallary` from any directory.\n\n## Option 3: Use npm Scripts (From `cli/`)\n\n```bash\n# From the CLI directory\ncd cli\nnpm run build\nnpm run start -- --help\nnpm run start -- profiles list\nnpm run start -- posts list\n```\n\n## Option 4: Use npm/npx (Published Package)\n\nAfter you publish or install the package from npm:\n\n```bash\n# Install globally\nnpm install -g @mallary/cli\n\n# Or use with npx (no global install)\nnpx @mallary/cli --help\nnpx @mallary/cli profiles list\nnpx @mallary/cli posts list\n```\n\n## Quick Setup Guide\n\nUse `mallary profiles list` to find a non-default profile ID. Replace `AbC123xYz90` in examples with a real public profile ID, or omit `--profile-id` to use the default profile.\n\n### Step 1: Build the CLI\n\n```bash\n# From the repository root\ncd cli\nnpm install\nnpm run build\n```\n\n### Step 2: Set Your API Key\n\nSecurity: `MALLARY_API_KEY` is a bearer secret. Do not commit it, paste it into prompts or tickets, print it in logs, or expose it in shell history. Use your password manager, a locked-down untracked env file, or a CI secret store for persistent use.\n\n```bash\nread -rsp \"Mallary API key: \" MALLARY_API_KEY; echo; export MALLARY_API_KEY\n```\n\n### Step 3: Choose Your Method\n\nFor quick testing:\n\n```bash\nnode cli/dist/index.js --help\n```\n\nFor regular use:\n\n```bash\ncd cli\nnpm link\nmallary --help\n```\n\n## Troubleshooting\n\n### \"Command not found: mallary\"\n\nIf you linked globally but still get this error:\n\n```bash\n# Make sure that the link exists\nwhich mallary\n\n# If it is not found, link it again\ncd cli\nnpm link\n\n# Or look at your PATH\necho $PATH\n```\n\n### \"MALLARY_API_KEY is not set\"\n\n```bash\nread -rsp \"Mallary API key: \" MALLARY_API_KEY; echo; export MALLARY_API_KEY\n\n# Make sure that it is set without printing the key\ntest -n \"${MALLARY_API_KEY:-}\" && echo \"MALLARY_API_KEY is set\"\n```\n\n### Permission Denied\n\nIf you get permission errors when you run the built file directly:\n\n```bash\n# Make the file executable\nchmod +x cli/dist/index.js\n\n# Then try again\n./cli/dist/index.js --help\n```\n\n### Rebuild After Changes\n\nAfter you change the code, build it again:\n\n```bash\ncd cli\nnpm run build\n```\n\nIf you linked globally, the new build applies to the `mallary` command.\n\n## Testing the CLI\n\n### Test Help Command\n\n```bash\nmallary --help\nnode cli/dist/index.js help posts create\n```\n\n### Test with Safe Read-Only Commands (requires API key)\n\n```bash\ntest -n \"${MALLARY_API_KEY:-}\" && echo \"MALLARY_API_KEY is set\"\n\n# Health check\nmallary health\n\n# Profile discovery\nmallary profiles list\n```\n\n### Optional Real Publish Check\n\nWarning: `mallary posts create` publishes or schedules content on the selected connected social-media account. Do not run it as a harmless test. First, make sure that the profile ID and the platform point to the account for the real public post.\n\n```bash\n# Publishes a real Facebook post to the selected profile\nmallary posts create \\\n --message \"Intentional publish from Mallary CLI\" \\\n --platform facebook \\\n --profile-id AbC123xYz90\n```\n\n## Development Workflow\n\n### 1. Make Changes\n\nEdit files in `cli/src/`.\n\n### 2. Rebuild\n\n```bash\ncd cli\nnpm run build\n```\n\n### 3. Test\n\n```bash\n# If linked globally\nmallary --help\n\n# Or direct execution\nnode cli/dist/index.js --help\n```\n\n### 4. Run Tests\n\n```bash\ncd cli\nnpm test\n```\n\n## Environment Variables\n\n### Required\n\n- `MALLARY_API_KEY` - your Mallary API key\n\nTreat `MALLARY_API_KEY` as a bearer credential. Store it in a secret manager, a locked-down untracked env file, or a masked CI secret. Do not commit it. Do not paste it into prompts or tickets. Do not print it with `echo` or `printenv`. Do not enable shell tracing around it. Do not share logs that contain it. If the key is exposed, rotate or revoke it.\n\n### Setting Environment Variables\n\nTemporary:\n\n```bash\n# For bash/zsh, without printing the key\nread -rsp \"Mallary API key: \" MALLARY_API_KEY; echo; export MALLARY_API_KEY\n\n# For fish, without printing the key\nread --silent --prompt-str \"Mallary API key: \" MALLARY_API_KEY; set -gx MALLARY_API_KEY $MALLARY_API_KEY\n\n# For PowerShell\n$env:MALLARY_API_KEY=\"your_key\"\n```\n\nPersistent local storage:\n\nUse a password manager, a shell secret plugin, an OS keychain, or an untracked env file with restrictive permissions. Do not write real keys into shared dotfiles. Do not write them into commands that the shell history can save.\n\n## Using Aliases\n\nIf you want a shorter command:\n\n```bash\n# Add to ~/.bashrc or ~/.zshrc\nalias my='mallary'\n\n# Now you can use\nmy posts list\n```\n\n## Production Deployment\n\n### Install from npm\n\n```bash\n# Global install\nnpm install -g @mallary/cli\n\n# Project-specific or one-off use\nnpx @mallary/cli --help\n```\n\n## Summary of Methods\n\n| Method | Command | Best For |\n| --------------------- | ---------------------------- | ---------------------- |\n| Direct node execution | `node cli/dist/index.js ...` | Quick local testing |\n| Direct executable | `./cli/dist/index.js ...` | Quick local testing |\n| npm link | `mallary ...` | Day-to-day development |\n| npm scripts | `npm run start -- ...` | Working inside `cli/` |\n| npm global install | `mallary ...` | Published usage |\n| npx | `npx @mallary/cli ...` | One-off usage |\n\n## Recommended Setup\n\n```bash\n# 1. Build\ncd cli && npm install && npm run build\n\n# 2. Link globally\nnpm link\n\n# 3. Confirm API key is available without printing it\ntest -n \"${MALLARY_API_KEY:-}\" && echo \"MALLARY_API_KEY is set\"\n\n# 4. Test\nmallary health\n\n# 5. Start with read-only commands\nmallary profiles list\n```\n\nDo not include `mallary posts create` in setup smoke tests. It publishes or schedules a post on a connected social-media account. Before you use the optional real publish check above, make sure that the target profile and the platform are correct. Also make sure that the message and the media are correct. Also make sure that the user wants a public or scheduled post.\n\nFile v1.1.5:PROFILES.md\n\n# Mallary Profiles\n\nProfiles group your social media accounts. You can create one profile for each of your businesses. Then connect the social media accounts of each business inside its profile. If you do not send a `profile_id` with a request, Mallary uses your default profile.\n\nMallary profiles group social platform connections, posts, analytics, and brand or AI auto-reply settings. The dashboard has one top-level **Dashboard profile** bar. After you select a profile there, the posts, platforms, analytics, and settings below belong to that profile.\n\n## Default Profile\n\nEvery user has a default profile. If a CLI command or API request omits `profile_id`, Mallary uses the user's default profile.\n\nWhen a user manages more than one brand, business, client, or set of social accounts, use a non-default profile.\n\n## Public Profile IDs\n\nProfiles have random public IDs such as `AbC123xYz90`. Use these public IDs in CLI flags and API payloads, not internal database IDs.\n\nFind the profile ID in either place:\n\nPrivacy warning: profile IDs, profile names, connected-platform state, and profile-scoped settings are sensitive operational metadata. Request only the profile ID that you need. Redact the profile details and the account details before you share logs, screenshots, tickets, or agent transcripts.\n\n```bash\nmallary profiles list\nmallary profiles list --json\n```\n\nOr copy it from the **Dashboard profile** bar in the Mallary dashboard.\n\n## CLI Commands That Accept Profiles\n\nThe CLI can list profiles and target a profile with `--profile-id`:\n\nWarning: the commands in this block are not all read-only. `posts create` publishes or schedules content. `settings update` changes the profile behavior. `platforms disconnect` ends the platform access of Mallary until you connect the platform again. Make sure that the target profile ID and the side effect are correct before you run these commands.\n\n```bash\nmallary profiles list\nmallary posts create --message \"Launch update\" --platform linkedin --profile-id AbC123xYz90\nmallary posts list --profile-id AbC123xYz90\nmallary analytics list --profile-id AbC123xYz90\nmallary audience list --profile-id AbC123xYz90\nmallary settings get --profile-id AbC123xYz90\nmallary settings update --file settings.partial.json --profile-id AbC123xYz90\nmallary platforms list --profile-id AbC123xYz90\nmallary platforms disconnect facebook --profile-id AbC123xYz90\n```\n\nIn file mode, send `profile_id` in the JSON payload:\n\n```json\n{\n \"profile_id\": \"AbC123xYz90\",\n \"message\": \"Launch update\",\n \"platforms\": [\"facebook\", \"linkedin\"]\n}\n```\n\nThe CLI lists profiles and targets them. The dashboard and the REST API create and rename profiles.\n\n## API Endpoints\n\nProfile-aware API behavior:\n\n- `GET /api/v1/profiles` lists profiles, each profile's connected platforms, and the user's profile/account limit.\n- `POST /api/v1/profiles` creates a named non-default profile.\n- `POST /api/v1/profiles/{id}` renames a profile.\n- you can send `profile_id` with these operations: create a post, list posts, list analytics, list platforms, disconnect a platform, and read or update settings.\n- Omitting `profile_id` selects the default profile.\n\n## Profile-Scoped Behavior\n\n- Platform connections are profile-scoped. Connect accounts in the dashboard after selecting the intended Dashboard profile.\n- Posts and grouped post history are profile-scoped.\n- Post analytics and audience queries are profile-scoped.\n- Settings are profile-scoped. They include `auto_reply_enabled`, the business fields, the brand profile text, and the AI auto-reply context.\n- `--auto-reply-enabled` on a post also depends on the saved settings of the selected profile and on the plan access.\n\n## Limits\n\n`GET /api/v1/profiles` returns `data.limits.max_accounts_per_platform`. When the user reaches the allowed profile count, the dashboard disables **New profile**.\n\nCurrent backend limit values:\n\n| Plan | Limit |\n| --- | ---: |\n| Free | 1 |\n| Starter | 4 |\n| Pro | 10 |\n| Business | 50 |\n\nCLI access is paid-plan only, but Free users still have a default profile in the dashboard.\n\nFile v1.1.5:PROJECT_STRUCTURE.md\n\n# Mallary CLI - Project Structure\n\n## Overview\n\nMallary CLI is the official command-line interface for the public Mallary API. This architecture guide starts with read-only inspection paths. It also inventories explicit-request, state-changing code paths later in the document. For an AI agent, an implemented code path is not authorization to suggest or use it.\n\n## Agent Safety Boundary\n\nThis file is an architecture inventory, not a workflow recommendation. An AI agent must:\n\n- start with the minimum read-only discovery needed for the user's request\n- never treat a listed command, endpoint, or code path as permission to invoke it\n- avoid suggesting an upload or state-changing command unless the user explicitly asks for that type of action\n- treat a clear request to publish, schedule, upload media for that post, or send a reply as authorization for that action; do not ask for a second confirmation\n- ask only for missing material details, keep the action within the request, run it once, and verify it with a read-only command\n\n## Directory Structure\n\n```text\ncli/\nā”œā”€ā”€ src/ # Source code\nā”‚ ā”œā”€ā”€ index.ts # CLI entry point\nā”‚ ā”œā”€ā”€ main.ts # Command parsing, request handling, rendering\nā”‚ ā”œā”€ā”€ oauth.ts # OAuth device flow, refresh, revocation, credential storage\nā”‚ ā””ā”€ā”€ version.ts # Version export\nā”‚\nā”œā”€ā”€ dist/ # Build output (generated)\nā”‚ ā”œā”€ā”€ index.js # Executable entry\nā”‚ ā”œā”€ā”€ main.js # Compiled command logic\nā”‚ ā”œā”€ā”€ oauth.js # Compiled OAuth logic\nā”‚ ā””ā”€ā”€ version.js # Compiled version module\nā”‚\nā”œā”€ā”€ test/ # CLI tests\nā”‚ ā”œā”€ā”€ cli.test.ts # Command and behavior tests\nā”‚ ā””ā”€ā”€ oauth-auth.test.ts # OAuth, refresh, precedence, and token-safety tests\nā”‚\nā”œā”€ā”€ package.json # Package configuration\nā”œā”€ā”€ package-lock.json # npm lockfile\nā”œā”€ā”€ tsconfig.json # TypeScript configuration\nā”œā”€ā”€ .gitignore # Git ignore rules\nā”œā”€ā”€ README.md # Main documentation\nā”œā”€ā”€ SKILL.md # AI agent usage guide\nā”œā”€ā”€ QUICK_START.md # Quick start guide\nā”œā”€ā”€ PROFILES.md # Profile IDs, scoping, API endpoints, and limits\nā”œā”€ā”€ PROJECT_STRUCTURE.md # This file\nā”œā”€ā”€ FEATURES.md # Feature summary\nā”œā”€ā”€ PROVIDER_SETTINGS.md # Provider-settings agent safety boundary\nā”œā”€ā”€ SUPPORTED_FILE_TYPES.md # Read-only media format reference\nā””ā”€ā”€ other supporting .md docs # Additional usage, workflow, and publishing notes\n```\n\n## File Descriptions\n\n### Source Files\n\n#### `src/index.ts`\n\n- executable entry point\n- imports `runCli()` from `main.ts`\n- exits with the returned CLI exit code\n\n#### `src/main.ts`\n\n- primary implementation file\n- uses the built-in `parseArgs` module of Node\n- validates CLI input\n- resolves local media files\n- uploads local files to Mallary\n- sends authenticated requests to the Mallary API\n- shows human output and JSON output\n\n#### `src/oauth.ts`\n\n- starts OAuth device authorization with read, publish, engage, and manage access in one login\n- exchanges and refreshes tokens without printing them\n- revokes OAuth access on logout\n- stores credentials outside the project with restrictive local permissions\n\n#### `src/version.ts`\n\n- exports the CLI version for the help output and the version output\n\n### Configuration Files\n\n#### `package.json`\n\n- package name: `@mallary/cli`\n- executable bin: `mallary`\n- scripts: `build`, `dev`, `start`, `test`\n- metadata for npm publishing\n\n#### `tsconfig.json`\n\n- TypeScript compiler configuration\n- outputs compiled files into `dist/`\n\n### Documentation Files\n\n#### `README.md`\n\n- read-only OpenClaw agent overview\n- intentionally omits write commands, payloads, and mutation workflows\n\n#### `SKILL.md`\n\n- condensed safety contract and command reference for AI agents and LLM-driven workflows\n\n#### `QUICK_START.md`\n\n- read-only installation, authentication, and discovery guide that routes any requested write to the request-handling rules in `SKILL.md`\n\n#### `PROFILES.md`\n\n- explains profiles, public profile IDs, profile-scoped resources, and plan limits\n- documents profile-aware CLI flags and API endpoints\n\n#### `PROJECT_STRUCTURE.md`\n\n- architecture overview\n- file descriptions\n- command flow and integration points\n\n### Test Files\n\n#### `test/cli.test.ts`\n\n- validates command behavior\n- checks input validation, upload handling, and API request shaping\n\n## Build Process\n\n### Development Build\n\n```bash\ncd cli\nnpm run build\n```\n\n- compiles TypeScript to ESM JavaScript\n- writes output to `dist/`\n\n### Production Build\n\n```bash\ncd cli\nnpm run build\n```\n\nBuild characteristics:\n\n1. compiles `src/index.ts`, `src/main.ts`, and `src/version.ts`\n2. preserves the executable entry file\n3. emits small, plain JS output rather than a bundled framework build\n\n### Output\n\n- `dist/index.js` - executable wrapper\n- `dist/main.js` - main compiled CLI logic\n- `dist/version.js` - version metadata\n\n## Commands Architecture\n\n### Command Flow\n\n```text\nRead-only or explicitly requested input\n ā†“\nsrc/index.ts\n ā†“\nrunCli() in src/main.ts\n ā†“\nArgument parsing / validation\n ā†“\nOptional local file upload handling (user-requested)\n ā†“\nAuthenticated request to Mallary API\n ā†“\nHuman output or --json output\n```\n\n### Read-Only Discovery Commands\n\nThis is the only command inventory intended for agent discovery. Request the minimum data needed and redact sensitive output before sharing it.\n\n1. `health` - check Mallary service health without authentication\n2. `profiles list` - inspect profile IDs and account structure\n3. `platforms list` - inspect connected-platform state\n4. `posts list` - inspect grouped post history and status\n5. `jobs get ` - inspect one job and its result\n6. `analytics list` - inspect available analytics rows\n7. `audience list` - inspect follower and subscriber counts\n8. `settings get` - inspect saved brand configuration\n9. `webhooks list` - inspect configured webhook destinations\n\n### Explicit-Request Code Paths (Syntax Intentionally Omitted)\n\nThe implementation also contains data-transmitting and state-changing handlers. Their executable CLI syntax is intentionally omitted from this agent-facing architecture guide. Their presence in `src/main.ts` is not permission to suggest or invoke them.\n\nIf the user explicitly asks for a state-changing Mallary action, follow the Agent Safety Boundary and `SKILL.md`: use read-only discovery only as needed, ask for missing material details, carry out a clear publishing request without another confirmation, run it once, and verify it with a read-only command.\n\n## Environment Variables\n\n| Variable | Required | Default | Usage |\n| --- | --- | --- | --- |\n| `MALLARY_API_KEY` | No | stored OAuth | Optional API-key override for CI or other non-interactive environments |\n\n### Credential Handling\n\nOAuth is the interactive default. It grants read, publish, engage, and manage access in one login, refreshes automatically, and stores credentials outside the project. Users do not choose scopes. When `MALLARY_API_KEY` is set, it takes precedence over stored OAuth.\n\n`MALLARY_API_KEY` is a bearer credential. It can authorize posts, uploads, webhook changes, settings updates, and account-management actions. Treat it as a secret.\n\n- Store keys in a local secret manager, a locked-down untracked env file, or a CI secret store. Never commit them to source control.\n- Avoid shell-history exposure: do not paste a real key into shared terminals, documentation, tickets, prompts, or screenshots.\n- Do not print keys with `echo`, `printenv`, debug traces, request logs, or CI output. Redact all characters except the last few before you share logs.\n- In CI, pass the key through masked secrets such as `secrets.MALLARY_API_KEY`. Disable shell tracing around Mallary commands. Restrict log access.\n- If a key appears in logs, chat, shell history, or a committed file, rotate or revoke it before you continue.\n\n## Dependencies\n\n### Runtime Dependencies\n\n- Node.js built-ins such as `fs/promises`, `path`, and `util`\n- global `fetch` available in Node 18+\n\n### Dev Dependencies\n\n- `typescript`\n- `tsx`\n- `vitest`\n- `@types/node`\n\n## Integration Points\n\n### With the Repository\n\n1. built from the standalone `cli/` package\n2. tested with `npm test`\n3. published from `cli/package.json`\n\n### With the Mallary API\n\nRead-only integration endpoints used during discovery:\n\n1. `GET /health`\n2. `GET /api/v1/profiles`\n3. `GET /api/v1/platforms`\n4. `GET /api/v1/posts`\n5. `GET /api/v1/jobs/{id}`\n6. `GET /api/v1/analytics`\n7. `GET /api/v1/audience`\n8. `GET /api/v1/settings`\n9. `GET /api/v1/webhooks`\n\nExplicit-request write endpoint paths are intentionally omitted from this agent-facing architecture guide. An endpoint implemented by the API is not authorization to call it.\n\nProfile-aware endpoints accept a public `profile_id`. If you omit it, Mallary selects the default Dashboard profile.\n\nAuthentication:\n\n- Bearer token from stored OAuth or `MALLARY_API_KEY`\n- OAuth device authorization, token refresh, and token revocation use `https://auth.mallary.ai`\n- CLI also sends `x-mallary-client: cli`\n\n## Publishing\n\n### To npm\n\n```bash\ncd cli\nnpm publish --access public\n```\n\n### Package Contents\n\n- `dist/`\n- `README.md`\n- `SKILL.md`\n- `PROFILES.md`\n\n## Testing\n\n### Manual Testing\n\n```bash\n# Build\ncd cli && npm run build\n\n# Test without OAuth or an API key. Authenticated commands must fail\nnode dist/index.js posts list\n\n# Test safe OAuth status output\nnode dist/index.js auth status\n\n# Test general help\nnode dist/index.js --help\n```\n\n### Automated Testing\n\n```bash\ncd cli\nnpm test\n```\n\n## Future Enhancements\n\n- more command-specific help without authentication\n- more platform-specific helper commands\n- more structured JSON output for automation-heavy workflows\n- more CLI-side checks for advanced `platform_options`\n\n## Support\n\n- Site: https://mallary.ai\n- Docs: https://docs.mallary.ai\n- Repository: https://github.com/mallarylabs/mallary-agent\n- Support: support@mallary.ai\n\nFile v1.1.5:PROVIDER_SETTINGS_SUMMARY.md\n\n# Provider Settings - Read-Only Boundary Summary\n\nThis summary is not publishing guidance. Operational provider schemas and publishing syntax are intentionally omitted.\n\n## Default\n\n- remain in read-only discovery\n- use only the minimum current profile and connection lookup needed\n- minimize and redact profile IDs, account labels, and connection details\n- do not infer publishing intent from a platform or provider question\n\n```bash\nmallary profiles list\nmallary platforms list --profile-id \n```\n\n## After an Explicit User Request\n\nAn explicit request for a provider-specific proposal permits only a local, non-executable preview. A clear request to publish authorizes that post without a second confirmation.\n\n- resolve the current profile and connected destinations read-only\n- collect all content, media, timing, privacy, disclosure, and destination-specific choices\n- ask only for a required choice that is missing or ambiguous; accept choices the user delegated\n- if the user asked to publish, run the requested action once without another confirmation\n- verify the result read-only\n\nInstallation, authentication, discovery, a general workflow, a preview, or an earlier write is not a request for a later action.\n\n## Omitted from This Agent-Facing Summary\n\n- publishing and upload commands\n- payload shapes and templates\n- provider field names and accepted values\n- media and scheduling workflows\n- cross-platform examples\n- destructive and account-management commands\n\nUse [SKILL.md](./SKILL.md) for the request-handling rules. Do not use another document to bypass this boundary.\n\nFile v1.1.5:PROVIDER_SETTINGS.md\n\n# Provider Settings - Agent Safety Boundary\n\n## Purpose\n\nThis document defines the safety boundary for provider-specific settings. It is not a field reference or publishing playbook.\n\nOperational provider schemas and publishing syntax are intentionally omitted. Do not infer a payload, media workflow, destination setting, or executable command from this file.\n\n## Default Behavior: Read Only\n\nAn AI agent must remain in read-only discovery unless the user explicitly requests a specific Mallary publishing action or proposal. General questions about supported platforms, account status, or provider behavior do not authorize drafting or executing a post.\n\nUse only the read-only command needed to resolve current state:\n\n```bash\nmallary profiles list\nmallary platforms list --profile-id \n```\n\nProfile IDs, profile names, account labels, and connection state are sensitive. Minimize and redact the output. Never reuse an older profile ID or connection snapshot as current state without checking it again.\n\n## If the User Explicitly Requests a Provider-Specific Post or Proposal\n\nA request for a proposal permits preparation of a local, non-executable preview only. A clear request to publish authorizes that post without a second confirmation.\n\n1. resolve the current profile and connected destinations with minimum read-only discovery\n2. gather the user's desired content, destination, media, timing, privacy, disclosure, and platform-specific choices\n3. consult authoritative Mallary product documentation only as needed to validate the request\n4. ask only for a required choice that is missing or ambiguous; accept choices the user delegated\n5. if the user asked to publish, run the requested action once without another confirmation\n6. verify it with a read-only command\n\nDo not guess a destination-specific choice. If a required choice is missing, stop and ask for it rather than selecting a default.\n\n## A Request Does Not Carry Forward\n\nInstallation, authentication, discovery, a general workflow, a local preview, or an earlier write is not a request for a later action. A clear current publishing request authorizes only the content and destinations it describes.\n\n## Intentionally Omitted\n\nTo prevent this agent-facing document from becoming an actionable publishing guide, it does not include:\n\n- publishing or upload commands\n- JSON request bodies or payload templates\n- provider field names or accepted values\n- media upload or thumbnail workflows\n- scheduling examples\n- cross-platform campaign examples\n- destructive or account-management commands\n\nFor a user-requested write, follow the command side-effect classification and request-handling rules in [SKILL.md](./SKILL.md). Do not use another document to bypass this boundary.\n\n## Review Checklist\n\nBefore any requested write, confirm that:\n\n- the current profile and every destination were verified read-only\n- the user supplied or delegated all destination-specific choices\n- every local file and URL belongs to the request\n- message, media, timing, privacy, disclosure, and side effects are explicit\n- the user clearly requested publishing rather than only a draft or preview\n- the action will run once and be verified read-only without a redundant confirmation\n\nIf any item is missing, remain read-only.\n\nFile v1.1.5:QUICK_START.md\n\n# Mallary CLI - Safe Setup Quick Start\n\nThis guide is the safe default for humans, CI jobs, and AI agents. It intentionally stops before uploads, publishing, replies, deletion, webhook changes, settings updates, or platform disconnection. A documented capability is not permission to use it.\n\nIf the user explicitly requests a state-changing Mallary action, stop using this setup guide and follow the request-handling rules in [SKILL.md](./SKILL.md).\n\n## 1. Install Only When Requested\n\nInstalling a package changes the local environment. An AI agent must not install Mallary unless the user explicitly asks for or approves the installation.\n\n```bash\nnpm install -g @mallary/cli\n# Or inspect help without a global install:\nnpx @mallary/cli --help\n```\n\n## 2. Sign In Once with OAuth\n\nIf the user explicitly asked for Mallary setup or authentication, start browser-based OAuth. One login grants read, publish, engage, and manage access:\n\n```bash\nmallary auth login\nmallary auth status\n```\n\nShow the Mallary verification URL and one-time code, then wait for the user to approve access in their browser. Never ask them to paste a password, OAuth token, or API key into chat. Do not ask the user to choose scopes or add scope flags. OAuth access does not publish or change anything during setup.\n\n`MALLARY_API_KEY` remains an optional fallback for CI or another environment where OAuth is not practical. If the user chooses it, load it from a masked secret store, never print it, and never paste it into a prompt. When set, it takes precedence over stored OAuth.\n\n## 3. Verify with the Lowest-Risk Commands\n\nStart with general help and service health:\n\n```bash\nmallary --help\nmallary health\n```\n\n`mallary health` is read-only and does not require authentication. Do not use a write command as an installation or authentication test.\n\n## 4. Use Only the Minimum Read-Only Discovery Needed\n\nThe following commands do not change Mallary state, but their output can expose profile IDs, account labels, post content, settings, webhook destinations, and provider metadata. Run only the command needed for the user's request and redact sensitive output before sharing it.\n\n```bash\nmallary profiles list\nmallary platforms list\nmallary posts list\nmallary jobs get \nmallary analytics list\nmallary audience list\nmallary settings get\nmallary webhooks list\n```\n\nFor a non-default profile, first obtain its current public ID with `mallary profiles list`, then pass that ID only to the read-only command needed for the request. Never reuse a profile ID or account snapshot as current state without checking it again.\n\n## 5. Stop Before Data Transfer or State Changes\n\nThis guide intentionally omits executable syntax for data-transmitting, publishing, destructive, and account-impacting commands. Do not infer or construct that syntax from other documentation during read-only discovery.\n\nIf the user clearly asks to publish, schedule, upload media for that post, or send a reply:\n\n1. use minimum read-only discovery to resolve the current profile and destination\n2. ask only for a material detail that is missing or ambiguous\n3. execute the requested action once without asking for another confirmation\n4. verify the result with a read-only command\n\nAn OAuth setup or discovery request is not a request to post. For deletion, disconnection, or another destructive account action, follow the stronger safeguards in [SKILL.md](./SKILL.md).\n\n## Troubleshooting\n\n### Authentication Required\n\nIf a read-only authenticated command returns `authentication_required`, run `mallary auth status`. If the user explicitly asked to authenticate, start `mallary auth login` and wait for browser approval. For an intentionally configured API key, restore it through the secret manager without printing it.\n\n### Command Not Found\n\nCheck whether the command is available without changing the installation:\n\n```bash\ncommand -v mallary\n```\n\nIf it is not installed, ask for approval before installing or linking it.\n\n### Read-Only API Errors\n\nCommon causes include:\n\n- the OAuth connection expired or was revoked, or an API key is invalid\n- the plan does not include the requested CLI feature\n- the requested profile ID is unknown or stale\n- the requested resource does not exist\n\nDo not test an error by uploading a file, creating content, or changing account state.\n\n## Next Step\n\nRemain in read-only mode unless the user explicitly requests a specific Mallary action. A clear publishing request authorizes that action; do not add a second confirmation. For destructive or account-access actions, follow [SKILL.md](./SKILL.md).\n\n## Links\n\n- Main site: https://mallary.ai\n- Docs: https://docs.mallary.ai\n- Profiles reference: [PROFILES.md](./PROFILES.md)\n- Pricing: https://mallary.ai/pricing\n- Repository: https://github.com/mallarylabs/mallary-agent\n- Support: support@mallary.ai\n\nFile v1.1.5:skill-card.md\n\n## Description:\n\nGuides agents using Mallary to inspect connected social accounts and, when explicitly requested, publish or manage social-media content.\n\nThis skill is ready for commercial/non-commercial use.\n\n## Publisher:\n\n[sammydigits](https://clawhub.ai/user/sammydigits)\n\n### License/Terms of Use:\n\nMIT-0\n\n## Use Case:\n\nSocial-media operators and developers use this skill to inspect Mallary profiles, posts, analytics, and connected accounts, or carry out explicitly requested publishing and account-management tasks.\n\n### Deployment Geography for Use:\n\nGlobal\n\n## Known Risks and Mitigations:\n\nRisk: OAuth setup grants access to read, publish, engage, and manage connected accounts.\n\nMitigation: Start authentication only at the user's request and explain the access before browser approval.\n\nRisk: Publishing or account changes can affect public content or the wrong profile.\n\nMitigation: Resolve the exact profile, destination, content, media, and timing from the user's request; perform the requested action once and verify it read-only.\n\nRisk: Credentials or transient CLI installs may expose connected accounts.\n\nMitigation: Keep tokens and API keys out of chat and logs, and use a reviewed or pinned CLI version rather than unpinned npx.\n\n## Reference(s):\n\n- [Mallary skill release on ClawHub](https://clawhub.ai/sammydigits/skills/mallary)\n- [Mallary website](https://mallary.ai/)\n- [Mallary CLI package](https://www.npmjs.com/package/@mallary/cli)\n\n## Skill Output:\n\n**Output Type(s):** [Text, Markdown, Shell commands, Guidance]\n\n**Output Format:** [Markdown with inline shell commands]\n\n**Output Parameters:** [1D]\n\n**Other Properties Related to Output:** [Read-only discovery by default; report the result of authorized actions without repeating them.]\n\n## Skill Version(s):\n\n1.1.5 (source: ClawHub server release)\n\n## Ethical Considerations:\n\nUsers should evaluate whether this skill is appropriate for their environment, review any generated or modified files before relying on them, and apply their organization's safety, security, and compliance requirements before deployment.\n\nFile v1.1.5:SUPPORTED_FILE_TYPES.md\n\n# Supported Media Formats (Read-Only Reference)\n\nThis file describes the media formats recognized by Mallary's public media path. It intentionally contains no upload or publishing commands. Reading a format table is not authorization to transmit a local file or publish content.\n\n## Agent Safety Boundary\n\nSelecting local media for a later Mallary action can send the file bytes outside the local machine to Mallary storage, the Mallary CDN, and supporting hosting providers. The media can then be hosted at a public Mallary file URL.\n\n- Start with read-only Mallary discovery.\n- Do not use an upload as a format test or smoke test.\n- Do not inspect or transmit more local file data than the user requested.\n- Never transmit sensitive, regulated, customer, private, secret-bearing, or unrelated files.\n- Before any transfer, make sure the local paths, target Dashboard profile, connected account, platform, message, timing, and expected result belong to a clear user request.\n- Ask only when one of those material details is missing or ambiguous. Do not ask for a second confirmation after a clear publishing request.\n- Execute the requested transfer once and never retry it automatically when the result is uncertain.\n\nExecutable upload and publishing syntax is intentionally omitted from this agent-facing reference.\n\n## MIME Type Detection\n\nMallary infers the media type from the local filename extension. Renaming a file does not convert its contents and can cause a MIME mismatch. Keep the extension aligned with the file's real format.\n\n## Supported Image Formats\n\n| Extension | MIME type | Public media path |\n| --------------- | ------------ | ----------------- |\n| `.png` | `image/png` | Supported |\n| `.jpg`, `.jpeg` | `image/jpeg` | Supported |\n| `.webp` | `image/webp` | Supported |\n| `.gif` | `image/gif` | Supported |\n| `.bmp` | `image/bmp` | Supported |\n\nPlatform rules can be narrower than Mallary's accepted input formats. Check the selected destination's current limits before uploading media for the requested post.\n\n## Supported Video Formats\n\n| Extension | MIME type | Public media path |\n| --------------- | ------------------ | ----------------- |\n| `.mp4` | `video/mp4` | Supported |\n| `.mov` | `video/quicktime` | Supported |\n| `.webm` | `video/webm` | Supported |\n| `.mkv` | `video/x-matroska` | Supported |\n| `.avi` | `video/x-msvideo` | Supported |\n| `.mpeg`, `.mpg` | `video/mpeg` | Supported |\n\n## Unsupported Public Upload Targets\n\n### Audio\n\n| Extension | Detected fallback | Public media path |\n| --------- | -------------------------- | ----------------- |\n| `.mp3` | `application/octet-stream` | Not supported |\n| `.wav` | `application/octet-stream` | Not supported |\n| `.ogg` | `application/octet-stream` | Not supported |\n| `.m4a` | `application/octet-stream` | Not supported |\n\n### Documents\n\n| Extension | Detected fallback | Public media path |\n| --------- | -------------------------- | ----------------- |\n| `.pdf` | `application/octet-stream` | Not supported |\n| `.doc` | `application/octet-stream` | Not supported |\n| `.docx` | `application/octet-stream` | Not supported |\n\nUnknown extensions also fall back to `application/octet-stream` and are not normal public media targets. Convert an unsupported asset locally into a real image or video format only when the user requests that separate local change.\n\n## Platform-Specific Media Notes\n\nThese are compatibility notes, not a user request to post.\n\n### TikTok\n\n- Video posts require exactly one video.\n- Photo posts support up to 35 `jpg`, `jpeg`, or `webp` images.\n- TikTok photo posts do not accept `png` images.\n\n### YouTube\n\n- A post requires exactly one video.\n- Regular-video custom thumbnails can use `jpg`, `jpeg`, or `png` up to 50 MB.\n- The recommended regular-video thumbnail dimensions are `1280x720` with a 16:9 ratio.\n- For YouTube Shorts, YouTube may store the thumbnail but show a video frame instead. Mallary returns a warning because the YouTube API cannot confirm the cover viewers will see.\n\n### Instagram\n\n- Stories use exactly one image or video and do not support captions or follow-up comments.\n- Reels use exactly one video.\n- Carousels use 2 to 10 image or video items.\n- Video and Reel covers can use a separate thumbnail.\n\n### Facebook\n\n- Video thumbnails can use `jpg`, `jpeg`, or `png` up to 10 MB.\n\n### X\n\n- A post supports up to 4 images, or 1 video, or 1 GIF.\n\n### LinkedIn\n\n- The current public path supports text-only posts or one image attachment.\n\n### Bluesky\n\n- A post can use up to four `jpg`, `jpeg`, `png`, or `webp` images, up to 2 MB each.\n- A video post uses one `mp4` file, up to 300 MB.\n- Do not mix images and video in one Bluesky post.\n- Media items can include alt text for accessibility.\n\n## Size and Provider Limits\n\nMallary's media path accepts files up to 5 GB. Each social platform applies separate type, duration, dimension, and size limits. A format accepted by Mallary can still be rejected by the destination platform.\n\n## Read-Only Troubleshooting\n\n- **Unsupported file type:** confirm the real extension and compare it with the tables above.\n- **MIME mismatch:** verify that the extension matches the actual file contents; do not fix this by renaming alone.\n- **File not found:** verify the path locally without transmitting the file.\n- **No permission:** confirm that the current user can read the file without changing broad filesystem permissions.\n- **Authentication error:** ask the user to restore the API key outside chat; never request or print the key.\n- **Uncertain remote result:** inspect existing Mallary state and do not repeat the transfer automatically.\n\n## Explicit Request Handoff\n\nWhen the user clearly requests a media transfer or publish action, follow the request-handling rules in `SKILL.md`. Ask only for missing material details and do not require another confirmation. This file does not authorize or supply an executable state-changing workflow.\n\nArchive v1.1.4: 12 files, 28821 bytes\n\nFiles: FEATURES.md (12698b), HOW_TO_RUN.md (6891b), PROFILES.md (4088b), PROJECT_STRUCTURE.md (10396b), PROVIDER_SETTINGS_SUMMARY.md (1609b), PROVIDER_SETTINGS.md (3296b), QUICK_START.md (4852b), README.md (5915b), skill-card.md (3296b), SKILL.md (9507b), SUPPORTED_FILE_TYPES.md (6208b), _meta.json (126b)\n\nFile v1.1.4:SKILL.md\n\n---\nname: mallary\ndescription: Use this skill only when the user explicitly asks to inspect, set up, or act through Mallary, the Mallary CLI, the Mallary API, Mallary MCP, or an existing Mallary workflow. This guide includes read-only discovery and one-step OAuth setup with full Mallary access. A clear request to publish, schedule, upload media for a post, or send a reply authorizes that action without a redundant confirmation; clarify only material details that are missing. Executable write syntax is intentionally omitted.\nversion: 1.0.18\nhomepage: https://mallary.ai/\nmetadata:\n openclaw:\n emoji: \"šŸŒŽ\"\n requires:\n bins:\n - mallary\n---\n\n# Mallary Agent Skill\n\n## Safety Contract\n\nStart with minimum read-only discovery unless the user clearly asks Mallary to perform an action. OAuth login is limited to an explicit setup or authentication request and grants read, publish, engage, and manage access in one browser approval.\n\n- Treat profile, account, post, comment, job, analytics, settings, and webhook output as sensitive.\n- Request only the data needed for the user's stated Mallary task.\n- Redact API keys, tokens, account identifiers, profile identifiers, post metadata, and customer data before sharing output.\n- A CLI capability is not authorization to use it.\n- Do not suggest or run a state-changing action during discovery.\n- Treat a clear current request to publish, schedule, upload media for a post, or send a reply as authorization for that action. Do not ask for a second confirmation.\n- A setup or authentication request alone is not a request to publish or change Mallary.\n\nThe Mallary product can transfer local files, publish or schedule content, post public replies, remove queued work, attach final URLs, change webhooks or settings, and disconnect accounts. Those actions can affect remote data, public content, or account access. Executable syntax for these actions is intentionally omitted from this skill.\n\n## Local Setup Boundary\n\nThe `malla\n\nArchive v1.1.3: 12 files, 28588 bytes\n\nFiles: FEATURES.md (12614b), HOW_TO_RUN.md (6891b), PROFILES.md (4088b), PROJECT_STRUCTURE.md (10396b), PROVIDER_SETTINGS_SUMMARY.md (1609b), PROVIDER_SETTINGS.md (3296b), QUICK_START.md (4852b), README.md (5915b), skill-card.md (2880b), SKILL.md (9507b), SUPPORTED_FILE_TYPES.md (6070b), _meta.json (126b)\n\nArchive v1.1.2: 12 files, 28100 bytes\n\nFiles: FEATURES.md (12207b), HOW_TO_RUN.md (6891b), PROFILES.md (4088b), PROJECT_STRUCTURE.md (10396b), PROVIDER_SETTINGS_SUMMARY.md (1609b), PROVIDER_SETTINGS.md (3296b), QUICK_START.md (4852b), README.md (5670b), skill-card.md (3038b), SKILL.md (8771b), SUPPORTED_FILE_TYPES.md (6070b), _meta.json (126b)\n\nArchive v1.1.1: 12 files, 27814 bytes\n\nFiles: FEATURES.md (12207b), HOW_TO_RUN.md (6891b), PROFILES.md (4088b), PROJECT_STRUCTURE.md (10396b), PROVIDER_SETTINGS_SUMMARY.md (1609b), PROVIDER_SETTINGS.md (3296b), QUICK_START.md (4852b), README.md (5670b), skill-card.md (2598b), SKILL.md (8771b), SUPPORTED_FILE_TYPES.md (5816b), _meta.json (126b)\n\nArchive v1.1.0: 12 files, 27845 bytes\n\nFiles: FEATURES.md (12095b), HOW_TO_RUN.md (6891b), PROFILES.md (4023b), PROJECT_STRUCTURE.md (10310b), PROVIDER_SETTINGS_SUMMARY.md (1609b), PROVIDER_SETTINGS.md (3296b), QUICK_START.md (4830b), README.md (5648b), skill-card.md (2952b), SKILL.md (8652b), SUPPORTED_FILE_TYPES.md (5816b), _meta.json (126b)\n\nArchive v1.0.9: 12 files, 27558 bytes\n\nFiles: FEATURES.md (12098b), HOW_TO_RUN.md (6891b), PROFILES.md (4023b), PROJECT_STRUCTURE.md (10226b), PROVIDER_SETTINGS_SUMMARY.md (1618b), PROVIDER_SETTINGS.md (3318b), QUICK_START.md (4877b), README.md (5695b), skill-card.md (2567b), SKILL.md (8152b), SUPPORTED_FILE_TYPES.md (5753b), _meta.json (126b)\n\nArchive v1.0.8: 12 files, 42963 bytes\n\nFiles: FEATURES.md (9535b), HOW_TO_RUN.md (6891b), PROFILES.md (4023b), PROJECT_STRUCTURE.md (9998b), PROVIDER_SETTINGS_SUMMARY.md (5496b), PROVIDER_SETTINGS.md (11461b), QUICK_START.md (9246b), README.md (27069b), skill-card.md (3156b), SKILL.md (29282b), SUPPORTED_FILE_TYPES.md (7989b), _meta.json (126b)\n\nArchive v1.0.7: 12 files, 43430 bytes\n\nFiles: FEATURES.md (9668b), HOW_TO_RUN.md (6788b), PROFILES.md (4040b), PROJECT_STRUCTURE.md (9867b), PROVIDER_SETTINGS_SUMMARY.md (5401b), PROVIDER_SETTINGS.md (11504b), QUICK_START.md (9116b), README.md (26906b), skill-card.md (2946b), SKILL.md (28953b), SUPPORTED_FILE_TYPES.md (7876b), _meta.json (126b)","readmeExcerpt":"Skill: Mallary Openclaw Skill Owner: sammydigits Summary: Use this skill only when the user explicitly asks to inspect, set up, or act through Mallary, the Mallary CLI, the Mallary API, Mallary MCP, or an existing Mallary workflow. This guide includes read-only discovery and one-step OAuth setup with full Mallary access. A clear request to publish, schedule, upload media for a post, or send a reply authorizes that ac","codeSnippets":[],"executableExamples":[{"language":"bash","snippet":"command -v mallary >/dev/null\nmallary auth status"},{"language":"bash","snippet":"# Service health\nmallary health\n\n# Dashboard profiles and connected accounts\nmallary profiles list\nmallary platforms list\nmallary platforms list --profile-id \n\n# Posts, comments, and jobs\nmallary drafts list\nmallary drafts get \nmallary posts list\nmallary posts list --profile-id \nmallary comments list --post-id \nmallary jobs get \n\n# Analytics\nmallary analytics list\nmallary analytics list --post-id \nmallary analytics list --profile-id \n\n# Account follower and subscriber counts\nmallary audience list\nmallary audience list --profile-id \n\n# Current settings and webhooks\nmallary settings get\nmallary settings get --profile-id \nmallary webhooks list\n\n# General command discovery\nmallary --help"},{"language":"bash","snippet":"npm install -g @mallary/cli\n# Or inspect help through a temporary npx invocation:\nnpx @mallary/cli --help"},{"language":"bash","snippet":"mallary auth login\nmallary auth status"},{"language":"bash","snippet":"mallary --help\nmallary health"},{"language":"bash","snippet":"mallary profiles list\nmallary platforms list\nmallary posts list\nmallary jobs get \nmallary analytics list\nmallary audience list\nmallary settings get\nmallary webhooks list\nmallary comments list --post-id "}],"parameters":null,"dependencies":[],"permissions":[],"extractedFiles":[{"path":"SKILL.md","content":"---\nname: mallary\ndescription: Use this skill only when the user explicitly asks to inspect, set up, or act through Mallary, the Mallary CLI, the Mallary API, Mallary MCP, or an existing Mallary workflow. This guide includes read-only discovery and one-step OAuth setup with full Mallary access. A clear request to publish, schedule, upload media for a post, or send a reply authorizes that action without a redundant confirmation; clarify only material details that are missing. Executable write syntax is intentionally omitted.\nversion: 1.0.19\nhomepage: https://mallary.ai/\nmetadata:\n openclaw:\n emoji: \"šŸŒŽ\"\n requires:\n bins:\n - mallary\n---\n\n# Mallary Agent Skill\n\n## Safety Contract\n\nStart with minimum read-only discovery unless the user clearly asks Mallary to perform an action. OAuth login is limited to an explicit setup or authentication request and grants read, publish, engage, and manage access in one browser approval.\n\n- Treat profile, account, post, comment, job, analytics, settings, and webhook output as sensitive.\n- Request only the data needed for the user's stated Mallary task.\n- Redact API keys, tokens, account identifiers, profile identifiers, post metadata, and customer data before sharing output.\n- A CLI capability is not authorization to use it.\n- Do not suggest or run a state-changing action during discovery.\n- Treat a clear current request to publish, schedule, upload media for a post, or send a reply as authorization for that action. Do not ask for a second confirmation.\n- A setup or authentication request alone is not a request to publish or change Mallary.\n\nThe Mallary product can transfer local files, publish or schedule content, post public replies, remove queued work, attach final URLs, change webhooks or settings, and disconnect accounts. Those actions can affect remote data, public content, or account access. Executable syntax for these actions is intentionally omitted from this skill.\n\n## Local Setup Boundary\n\nThe `mallary` binary must already be available. Checking the binary and the current authentication status is read-only and does not print credentials:\n\n```bash\ncommand -v mallary >/dev/null\nmallary auth status\n```\n\nIf the binary is missing, stop and ask the user to install it or explicitly approve a local installation. Do not run a package-manager install automatically.\n\nIf the user explicitly asks to set up or authenticate Mallary, use `mallary auth login`. It requests all Mallary capabilities in one flow. Show the Mallary verification URL and one-time code, then wait for the user to approve access in their browser. Never ask for or print their Mallary password, OAuth tokens, or API key.\n\nDo not ask the user to choose OAuth scopes or add scope flags. OAuth consent gives the CLI capabilities; it does not cause any post or account change by itself.\n\nAn API key remains an optional fallback for CI or another environment where OAuth is not practical. If the user chooses it, ask them to set it through thei"},{"path":"README.md","content":"# Mallary CLI - OpenClaw Safety Guide\n\nThis README is the safe agent-facing overview for the Mallary OpenClaw skill. It is intentionally not the full human CLI manual and does not provide executable syntax for data transfer, publishing, replies, deletion, webhook changes, settings changes, or platform disconnection.\n\nA documented or implemented capability is not authorization. AI agents must begin with minimum read-only discovery and must not infer a write request from this file.\n\n## Safety Contract\n\n- use Mallary only when the user explicitly asks for Mallary or provides an existing Mallary workflow to inspect\n- begin with the lowest-risk read-only command that can answer the request\n- request the minimum data needed and redact sensitive operational output before sharing it\n- never use a data-transmitting or state-changing action as a setup, authentication, or smoke test\n- if the user clearly requests publishing, scheduling, an upload for that post, or a reply, follow [SKILL.md](./SKILL.md), resolve any missing material detail, and execute without asking for another confirmation\n- run a requested action once and verify it with a read-only command\n\nInstallation, authentication, or discovery alone is not a request to publish or change Mallary.\n\n## Install Only When Requested\n\nInstallation changes the local environment. An AI agent must not install or update the package unless the user explicitly asks for or approves it.\n\n```bash\nnpm install -g @mallary/cli\n# Or inspect help through a temporary npx invocation:\nnpx @mallary/cli --help\n```\n\n## OAuth and Credential Safety\n\nFor an explicit Mallary setup or authentication request, use browser-based OAuth. One login grants all Mallary capabilities:\n\n```bash\nmallary auth login\nmallary auth status\n```\n\nShow the user only the Mallary verification URL and one-time code, then wait for browser approval. Never ask the user to paste a password, API key, access token, or refresh token into chat. Do not ask the user to choose scopes or add scope flags. OAuth access does not publish or change anything during setup.\n\n`MALLARY_API_KEY` remains an optional fallback for CI or another environment where OAuth is not practical. It is a bearer secret. If the user intentionally chooses an API key:\n\n- load it from a password manager, locked-down untracked environment file, or masked CI secret\n- never paste it into prompts, tickets, screenshots, documentation, or shell commands that enter history\n- never print it with `echo`, `printenv`, shell tracing, debug logs, or CI output\n- rotate or revoke it if exposed\n\nWhen `MALLARY_API_KEY` is set, it takes precedence over stored OAuth access.\n\n## Lowest-Risk Verification\n\nUse general help and service health for installation or connectivity checks:\n\n```bash\nmallary --help\nmallary health\n```\n\n`mallary health` is read-only and does not require authentication.\n\n## Read-Only Discovery Commands\n\nRun only the command needed for the user's request:\n\n```bash\nmallary profiles list\nmallary pla"},{"path":"_meta.json","content":"{\n \"ownerId\": \"kn76b3gakkp8xdk4rrcaewvadx84s1fy\",\n \"slug\": \"mallary\",\n \"version\": \"1.1.6\",\n \"publishedAt\": 1791551851714\n}"},{"path":"FEATURES.md","content":"# Mallary CLI - Feature Summary\n\n## Complete Feature Set\n\nMallary CLI is the official command-line interface for Mallary.ai. Its read-only commands let developers, operators, CI jobs, and AI agents inspect jobs, analytics, settings, profiles, webhooks, and connected platforms. It also has write-capable commands for uploads, publishing, replies, webhook changes, settings updates, post deletion, TikTok URL attachment, and platform disconnection. Those capabilities do not give an AI agent permission to use them.\n\nThe CLI mirrors the public Mallary API. It does not bypass plan limits, feature gates, connected-account requirements, or platform validation rules.\n\n## AI Agent Safety Contract\n\nThis feature list describes what the CLI can do. It is not a user request to run a state-changing command.\n\n- Start with the minimum read-only discovery needed for the request. Prefer `mallary health`, `mallary profiles list`, `mallary platforms list`, `mallary posts list`, `mallary jobs get`, `mallary analytics list`, `mallary audience list`, `mallary settings get`, or `mallary webhooks list`.\n- Treat discovery output as sensitive. Request only needed fields and redact profile IDs, account labels, post data, settings, and webhook details before sharing them.\n- Run an upload, post, reply, delete, TikTok URL attachment, webhook change, settings update, or platform disconnect only when the user clearly requests that type of action.\n- A clear request to publish, schedule, upload media for that post, or send a reply authorizes that action. Ask only for a material detail that is missing or ambiguous; do not ask for a second confirmation.\n- Keep the action within the request, run it once, and use a read-only command to verify the result. Never use a write command as a smoke test.\n\nFor unattended CI, the owner must define the exact command, profile, destinations, payload source, and intended side effect in that workflow. Do not broaden that authorization at runtime.\n\n### Posts with Comments and Media - FULLY SUPPORTED\n\nMallary supports both simple post creation and advanced payload-based publishing.\n\n#### Posts with Comments\n\n- You can attach follow-up comments with repeatable `--comment` flags in flag mode.\n- In file mode, use `comments_under_post` in the JSON payload.\n- The public API currently limits follow-up comments to 3 items.\n\n#### Multiple Media per Post/Comment\n\n- Mallary supports multi-media posts where the target platform allows it.\n- The CLI uploads local file paths before it sends the post request.\n- The CLI also uploads local video thumbnail paths in `media[].thumbnail_url`.\n- The CLI rejects remote third-party media URLs.\n- The CLI accepts `https://files.mallary.ai/...` URLs.\n\n#### Multi-Platform Posting\n\n- One `posts create` request can target multiple platforms at once.\n- Use repeatable `--platform` flags in flag mode.\n- Use `--post-type` in flag mode when every selected platform should use the same supported type, such as `story` for Facebook and Instag"},{"path":"HOW_TO_RUN.md","content":"# How to Run the Mallary CLI\n\nYou can run the CLI in several ways.\n\n## Option 1: Run the Built File Directly\n\nThe built file at `cli/dist/index.js` is executable.\n\n```bash\n# From the repository root\nnode cli/dist/index.js --help\n\n# Or run it directly (it has a shebang)\n./cli/dist/index.js --help\n\n# Example authenticated command. Set MALLARY_API_KEY from a secret store first\ntest -n \"${MALLARY_API_KEY:-}\" && echo \"MALLARY_API_KEY is set\"\nnode cli/dist/index.js posts list\nnode cli/dist/index.js profiles list\n```\n\n## Option 2: Link Globally (Recommended for Development)\n\nThis creates a global `mallary` command you can use anywhere.\n\n```bash\n# From the CLI directory\ncd cli\nnpm link\n\n# Now you can use it anywhere\nmallary --help\nmallary profiles list\nmallary posts list\n\n# To unlink later\nnpm unlink -g @mallary/cli\n```\n\nAfter you link the package, you can use `mallary` from any directory.\n\n## Option 3: Use npm Scripts (From `cli/`)\n\n```bash\n# From the CLI directory\ncd cli\nnpm run build\nnpm run start -- --help\nnpm run start -- profiles list\nnpm run start -- posts list\n```\n\n## Option 4: Use npm/npx (Published Package)\n\nAfter you publish or install the package from npm:\n\n```bash\n# Install globally\nnpm install -g @mallary/cli\n\n# Or use with npx (no global install)\nnpx @mallary/cli --help\nnpx @mallary/cli profiles list\nnpx @mallary/cli posts list\n```\n\n## Quick Setup Guide\n\nUse `mallary profiles list` to find a non-default profile ID. Replace `AbC123xYz90` in examples with a real public profile ID, or omit `--profile-id` to use the default profile.\n\n### Step 1: Build the CLI\n\n```bash\n# From the repository root\ncd cli\nnpm install\nnpm run build\n```\n\n### Step 2: Set Your API Key\n\nSecurity: `MALLARY_API_KEY` is a bearer secret. Do not commit it, paste it into prompts or tickets, print it in logs, or expose it in shell history. Use your password manager, a locked-down untracked env file, or a CI secret store for persistent use.\n\n```bash\nread -rsp \"Mallary API key: \" MALLARY_API_KEY; echo; export MALLARY_API_KEY\n```\n\n### Step 3: Choose Your Method\n\nFor quick testing:\n\n```bash\nnode cli/dist/index.js --help\n```\n\nFor regular use:\n\n```bash\ncd cli\nnpm link\nmallary --help\n```\n\n## Troubleshooting\n\n### \"Command not found: mallary\"\n\nIf you linked globally but still get this error:\n\n```bash\n# Make sure that the link exists\nwhich mallary\n\n# If it is not found, link it again\ncd cli\nnpm link\n\n# Or look at your PATH\necho $PATH\n```\n\n### \"MALLARY_API_KEY is not set\"\n\n```bash\nread -rsp \"Mallary API key: \" MALLARY_API_KEY; echo; export MALLARY_API_KEY\n\n# Make sure that it is set without printing the key\ntest -n \"${MALLARY_API_KEY:-}\" && echo \"MALLARY_API_KEY is set\"\n```\n\n### Permission Denied\n\nIf you get permission errors when you run the built file directly:\n\n```bash\n# Make the file executable\nchmod +x cli/dist/index.js\n\n# Then try again\n./cli/dist/index.js --help\n```\n\n### Rebuild After Changes\n\nAfter you change the code, build it again:\n\n```bash\ncd cli\nnpm run build\n```\n\nIf you li"}],"languages":[],"docsSourceLabel":"CLAWHUB","editorialOverview":null,"editorialQuality":{"score":100,"threshold":65,"status":"thin","wordCount":1639,"uniquenessScore":34,"reasons":["uniqueness-below-45"]}},"media":{"evidence":{"source":"no-media","verified":false,"confidence":"low","updatedAt":"2026-10-09T17:41:20.439Z","emptyReason":"No screenshots, media assets, or demo links are available."},"primaryImageUrl":null,"mediaAssetCount":0,"assets":[],"demoUrl":null},"ownerResources":{"evidence":{"source":"unclaimed","verified":false,"confidence":"low","updatedAt":"2026-10-09T17:41:20.439Z","emptyReason":"This page has not been claimed by the agent owner."},"hasCustomPage":false,"customPageUpdatedAt":null,"customLinks":[],"structuredLinks":{"docsUrl":null,"demoUrl":null,"supportUrl":null,"pricingUrl":null,"statusUrl":null},"customPage":null},"relatedAgents":{"evidence":{"source":"protocol-neighbors","verified":false,"confidence":"medium","updatedAt":"2026-10-09T19:20:10.969Z","emptyReason":null},"items":[{"id":"8ebccd8e-3863-4187-8355-c3f14e1f9edf","entityType":"agent","canonicalPath":"/agent/iofficeai-aionui","slug":"iofficeai-aionui","name":"AionUi","description":"Free, local, open-source 24/7 Cowork app and OpenClaw for Gemini CLI, Claude Code, Codex, OpenCode, Qwen Code, Goose CLI, Auggie, and more | šŸŒŸ Star if you like it!","url":"https://github.com/iOfficeAI/AionUi","homepage":"https://www.aionui.com","source":"GITHUB_REPOS","protocols":["MCP","OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-10-09T19:11:12.944Z","createdAt":"2026-02-25T03:38:16.584Z","downloads":null},{"id":"b917f68a-ebff-438e-84f8-3f4b2494c0bc","entityType":"agent","canonicalPath":"/agent/activepieces-activepieces","slug":"activepieces-activepieces","name":"activepieces","description":"AI Agents & MCPs & AI Workflow Automation ā€¢ (~400 MCP servers for AI agents) ā€¢ AI Automation / AI Agent with MCPs ā€¢ AI Workflows & AI Agents ā€¢ MCPs for AI Agents","url":"https://github.com/activepieces/activepieces","homepage":"https://www.activepieces.com","source":"GITHUB_REPOS","protocols":["OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-04-15T02:22:12.426Z","createdAt":"2026-02-25T03:38:12.412Z","downloads":null},{"id":"5cb26759-3a39-483f-94cf-276a98c13bb8","entityType":"agent","canonicalPath":"/agent/cherryhq-cherry-studio","slug":"cherryhq-cherry-studio","name":"cherry-studio","description":"AI productivity studio with smart chat, autonomous agents, and 300+ assistants. Unified access to frontier LLMs","url":"https://github.com/CherryHQ/cherry-studio","homepage":"https://cherry-ai.com","source":"GITHUB_REPOS","protocols":["MCP","OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-04-11T14:38:40.986Z","createdAt":"2026-02-25T03:38:19.379Z","downloads":null},{"id":"6f6582d0-5d76-4f0f-b81d-86520247950b","entityType":"agent","canonicalPath":"/agent/copilotkit-copilotkit","slug":"copilotkit-copilotkit","name":"CopilotKit","description":"The Frontend for Agents & Generative UI. React + Angular","url":"https://github.com/CopilotKit/CopilotKit","homepage":"https://docs.copilotkit.ai","source":"GITHUB_REPOS","protocols":["OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-03-25T09:50:57.846Z","createdAt":"2026-02-25T03:39:14.617Z","downloads":null}],"links":{"hub":"/agent","source":"/agent/source/clawhub","protocols":[{"label":"OpenClaw","href":"/agent/protocol/openclew"}]}}}