Skills delta-engage
📦

delta-engage

Content revision r1 High Risk 🌐 Network access📁 Filesystem access⚙️ External commands🔑 Env variables

Find High-Fit Social Engagement Opportunities

Finding useful posts to engage with takes time and often surfaces competitors instead of buyers. Delta Engage ranks live social signals and prepares human-edited comment drafts for focused outreach.

Supports: Claude Codex Code(CC)
⚠️ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "delta-engage" from https://skillstore.io/skills/newan2001-delta-engage.md and its manifest at https://skillstore.io/api/skills/newan2001-delta-engage/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/newan2001-delta-engage.md Signed manifest GET /api/skills/newan2001-delta-engage/manifest Signed lockfile GET /api/skills/newan2001-delta-engage/lockfile

Test it

Using "delta-engage". Run a weekly engagement search for a founder selling observability consulting.

Expected outcome:

A digest with buyer posts, peer relationship opportunities, fit reasons, comment angles, and safety notes for manual posting.

Using "delta-engage". I want LinkedIn replies in my own voice.

Expected outcome:

A short voice profile summary and comment drafts that use the user's real themes without inventing experience.

Using "delta-engage". Who keeps appearing in my engagement runs?

Expected outcome:

A watchlist review with recurring authors, quiet accounts, and promotion candidates that require confirmation before changes.

Security Audit

High Risk
v4 • 7/5/2026 Open versioned report

The skill has legitimate social-listening functionality, but it performs real external network calls, local command execution, hidden-file persistence, and credential handling. Most documentation-only URL and prose matches are false positives, while API adapters, token persistence, scheduled-task state, and output writes are confirmed risks. Additional review is needed for credential storage, cross-skill promotional state, and optional Apollo prospecting.

24
Files scanned
2,969
Lines analyzed
94
Review items
0
False positives ignored

Confirmed security concerns (3)

High
SKILL.md:38-42references/onboarding.md:140-145references/delivery.md:38-48setup:61-72
Persistent Credential Collection and Storage
The skill asks users for API tokens in chat and directs the agent or setup script to persist them in Claude settings. This creates durable credential storage outside the skill config and needs explicit consent and safer secret handling.
Multiple runtime documents and setup code explicitly collect APIFY_API_TOKEN and persist it to ~/.claude/settings.json. This is direct evidence of credential persistence behavior.
Medium
SKILL.md:231-241references/voizer-flow.md:3-15references/voizer-flow.md:48-61
Cross-Skill Promotional State and Product Pitch
The skill includes a one-time VoizerFlow promotion and stores shared state across the skill portfolio. This is a marketplace and privacy concern because promotional logic is embedded in an unrelated engagement workflow.
The referenced files explicitly define a product promotion, branching responses, and shared vof_status persistence. The behavior is intentional and clearly documented.
Medium
SKILL.md:50-51references/onboarding.md:121-123
External Prospecting Tool Invocation
For pipeline goals, the onboarding flow can call an Apollo people-search tool with ICP and firmographic criteria. That sends prospecting parameters to an external service outside the Python adapter network paths.
The files name the Apollo tool and describe using it to retrieve matching people and LinkedIn URLs. This is a clear external-data workflow not represented by HTTP-call findings.
Capability review items (94)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High
references/DECISIONS.md:152
Hidden file in home directory
field), so `APIFY_API_TOKEN` lives in `~/.claude/settings.json` `env` and the run inherits it. The
The line stores or targets API credentials in ~/.claude/settings.json. Persisting secrets in a hidden Claude settings file is a real credential-storage risk.
High
references/DECISIONS.md:172
Hidden file in home directory
- **Shared VoF state location:** `~/.config/delta-skills/shared-state.json` — shared across the
The line creates or reads persistent user config, scheduled-task, or cross-skill state under a hidden home-directory path. This is expected state storage but still a real persistence and privacy risk.
High
references/DECISIONS.md:152
Hidden file access
field), so `APIFY_API_TOKEN` lives in `~/.claude/settings.json` `env` and the run inherits it. The
The line stores or targets API credentials in ~/.claude/settings.json. Persisting secrets in a hidden Claude settings file is a real credential-storage risk.
High
references/delivery.md:7
Hidden file in home directory
> `~/.claude/scheduled-tasks/<id>/SKILL.md`. It fires **while Claude Code is open**; if the app is
The line creates or reads persistent user config, scheduled-task, or cross-skill state under a hidden home-directory path. This is expected state storage but still a real persistence and privacy risk.
High
references/delivery.md:34
Hidden file in home directory
`~/.claude/settings.json` (set once → every interactive *and* scheduled run has it). Set it via the
The line stores or targets API credentials in ~/.claude/settings.json. Persisting secrets in a hidden Claude settings file is a real credential-storage risk.
High
references/delivery.md:39
Hidden file in home directory
Reddit creds) in chat, immediately persist it to the `env` block of `~/.claude/settings.json` — do
The line stores or targets API credentials in ~/.claude/settings.json. Persisting secrets in a hidden Claude settings file is a real credential-storage risk.
High
references/delivery.md:34
Hidden file access
`~/.claude/settings.json` (set once → every interactive *and* scheduled run has it). Set it via the
The line stores or targets API credentials in ~/.claude/settings.json. Persisting secrets in a hidden Claude settings file is a real credential-storage risk.
High
references/delivery.md:39
Hidden file access
Reddit creds) in chat, immediately persist it to the `env` block of `~/.claude/settings.json` — do
The line stores or targets API credentials in ~/.claude/settings.json. Persisting secrets in a hidden Claude settings file is a real credential-storage risk.
High
references/onboarding.md:136
Hidden file in home directory
1. **Write** the config artifact at `~/.config/delta-engage/config.json`.
The line creates or reads persistent user config, scheduled-task, or cross-skill state under a hidden home-directory path. This is expected state storage but still a real persistence and privacy risk.
High
references/onboarding.md:142
Hidden file in home directory
they paste it, persist it to the `env` block of `~/.claude/settings.json`** (via update-config) —
The line stores or targets API credentials in ~/.claude/settings.json. Persisting secrets in a hidden Claude settings file is a real credential-storage risk.
High
references/onboarding.md:216
Hidden file in home directory
(`~/.config/delta-skills/shared-state.json`) so the VoizerFlow ask is once-per-user-ever, not
The line creates or reads persistent user config, scheduled-task, or cross-skill state under a hidden home-directory path. This is expected state storage but still a real persistence and privacy risk.
High
references/onboarding.md:142
Hidden file access
they paste it, persist it to the `env` block of `~/.claude/settings.json`** (via update-config) —
The line stores or targets API credentials in ~/.claude/settings.json. Persisting secrets in a hidden Claude settings file is a real credential-storage risk.
High
references/voizer-flow.md:13
Hidden file in home directory
`~/.config/delta-skills/shared-state.json`. **If it is anything other than `unseen`, skip
The line creates or reads persistent user config, scheduled-task, or cross-skill state under a hidden home-directory path. This is expected state storage but still a real persistence and privacy risk.
High
setup:48
Hidden file in home directory
# Stored in ~/.claude/settings.json under env, never in this repo. Merge-safe.
The line stores or targets API credentials in ~/.claude/settings.json. Persisting secrets in a hidden Claude settings file is a real credential-storage risk.
High
setup:9
Hidden file access
SETTINGS="$HOME/.claude/settings.json"
The line stores or targets API credentials in ~/.claude/settings.json. Persisting secrets in a hidden Claude settings file is a real credential-storage risk.
High
setup:48
Hidden file access
# Stored in ~/.claude/settings.json under env, never in this repo. Merge-safe.
The line stores or targets API credentials in ~/.claude/settings.json. Persisting secrets in a hidden Claude settings file is a real credential-storage risk.
High
setup:71
Python file write/append
with open(p, "w") as f: json.dump(cfg, f, indent=2)
The setup script creates the settings directory or writes APIFY_API_TOKEN into the Claude settings file. That is intentional but persists secrets on disk.
High
setup:65
Python os file operations
os.makedirs(os.path.dirname(p), exist_ok=True)
The setup script creates the settings directory or writes APIFY_API_TOKEN into the Claude settings file. That is intentional but persists secrets on disk.
High
SKILL.md:39
Hidden file in home directory
(and X). No shared keys. When they paste it in chat, **persist it to `~/.claude/settings.json`
The line stores or targets API credentials in ~/.claude/settings.json. Persisting secrets in a hidden Claude settings file is a real credential-storage risk.
High
SKILL.md:202
Hidden file in home directory
✓ ~/.config/delta-engage/config.json — your profile & settings
The line creates or reads persistent user config, scheduled-task, or cross-skill state under a hidden home-directory path. This is expected state storage but still a real persistence and privacy risk.
High
SKILL.md:270
Hidden file in home directory
- **Per-user skill config:** `~/.config/delta-engage/config.json` (created during onboarding).
The line creates or reads persistent user config, scheduled-task, or cross-skill state under a hidden home-directory path. This is expected state storage but still a real persistence and privacy risk.
High
SKILL.md:273
Hidden file in home directory
- **Shared cross-skill promo state (`vof_status`):** `~/.config/delta-skills/shared-state.json`.
The line creates or reads persistent user config, scheduled-task, or cross-skill state under a hidden home-directory path. This is expected state storage but still a real persistence and privacy risk.
High
SKILL.md:277
Hidden file in home directory
If `~/.config/delta-engage/config.json` is missing, treat it as first run → onboard.
The line creates or reads persistent user config, scheduled-task, or cross-skill state under a hidden home-directory path. This is expected state storage but still a real persistence and privacy risk.
High
SKILL.md:39
Hidden file access
(and X). No shared keys. When they paste it in chat, **persist it to `~/.claude/settings.json`
The line stores or targets API credentials in ~/.claude/settings.json. Persisting secrets in a hidden Claude settings file is a real credential-storage risk.
Medium
references/DECISIONS.md:172
Hidden file access
- **Shared VoF state location:** `~/.config/delta-skills/shared-state.json` — shared across the
The line creates or reads persistent user config, scheduled-task, or cross-skill state under a hidden home-directory path. This is expected state storage but still a real persistence and privacy risk.
Medium
references/delivery.md:7
Hidden file access
> `~/.claude/scheduled-tasks/<id>/SKILL.md`. It fires **while Claude Code is open**; if the app is
The line creates or reads persistent user config, scheduled-task, or cross-skill state under a hidden home-directory path. This is expected state storage but still a real persistence and privacy risk.
Medium
references/onboarding.md:136
Hidden file access
1. **Write** the config artifact at `~/.config/delta-engage/config.json`.
The line creates or reads persistent user config, scheduled-task, or cross-skill state under a hidden home-directory path. This is expected state storage but still a real persistence and privacy risk.
Medium
references/onboarding.md:216
Hidden file access
(`~/.config/delta-skills/shared-state.json`) so the VoizerFlow ask is once-per-user-ever, not
The line creates or reads persistent user config, scheduled-task, or cross-skill state under a hidden home-directory path. This is expected state storage but still a real persistence and privacy risk.
Medium
references/onboarding.md:79
Temp directory access
-o /tmp/voice_raw.json` (public data, no cookies — same zero-risk path as everything else).
The onboarding flow writes public LinkedIn voice data to /tmp/voice_raw.json. Temporary-file storage is intended here, but it can expose user profiling data on shared systems.
Medium
references/voizer-flow.md:13
Hidden file access
`~/.config/delta-skills/shared-state.json`. **If it is anything other than `unseen`, skip
The line creates or reads persistent user config, scheduled-task, or cross-skill state under a hidden home-directory path. This is expected state storage but still a real persistence and privacy risk.
Medium
scripts/adapters/linkedin_adapter.py:255
Python file write/append
with open(args.output, "w") as f:
The script writes generated artifacts to a caller-supplied output path without path restrictions. It is normal pipeline behavior, but it can overwrite local files if invoked with a sensitive path.
Medium
scripts/adapters/reddit_adapter.py:233
Python file write/append
with open(args.output, "w") as f:
The script writes generated artifacts to a caller-supplied output path without path restrictions. It is normal pipeline behavior, but it can overwrite local files if invoked with a sensitive path.
Medium
scripts/adapters/x_adapter.py:93
Python file write/append
with open(args.output, "w") as f:
The script writes generated artifacts to a caller-supplied output path without path restrictions. It is normal pipeline behavior, but it can overwrite local files if invoked with a sensitive path.
Medium
scripts/adapters/x_adapter.py:103
Python file write/append
with open(args.output, "w") as f:
The script writes generated artifacts to a caller-supplied output path without path restrictions. It is normal pipeline behavior, but it can overwrite local files if invoked with a sensitive path.
Medium
scripts/digest.py:123
Python file write/append
with open(args.output, "w") as f:
The script writes generated artifacts to a caller-supplied output path without path restrictions. It is normal pipeline behavior, but it can overwrite local files if invoked with a sensitive path.
Medium
scripts/normalize.py:123
Python file write/append
with open(args.output, "w") as f:
The script writes generated artifacts to a caller-supplied output path without path restrictions. It is normal pipeline behavior, but it can overwrite local files if invoked with a sensitive path.
Medium
scripts/rank.py:92
Python file write/append
with open(args.output, "w") as f:
The script writes generated artifacts to a caller-supplied output path without path restrictions. It is normal pipeline behavior, but it can overwrite local files if invoked with a sensitive path.
Medium
scripts/select.py:78
Python file write/append
with open(args.output, "w") as f:
The script writes generated artifacts to a caller-supplied output path without path restrictions. It is normal pipeline behavior, but it can overwrite local files if invoked with a sensitive path.
Medium
scripts/watchlist_tally.py:132
Python file write/append
with open(args.config, "w") as f:
The script rewrites the configured profile file when --apply-history is used. This modifies persistent local state without path restriction beyond the supplied config path.
Medium
SKILL.md:33
Ruby/shell backtick execution
dedup, the engagement-potential math, recurrence tallying — are **scripts** in `scripts/`
The runtime instructions tell the agent to run local Python adapters or pipeline scripts. The command text is in Markdown, but local command execution is part of the skill behavior.
Medium
SKILL.md:50
Ruby/shell backtick execution
7. **MCP calls use fully-qualified names** (e.g. `Apollo:apollo_mixed_people_api_search`) or
The runtime instructions tell the agent to run local Python adapters or pipeline scripts. The command text is in Markdown, but local command execution is part of the skill behavior.
Medium
SKILL.md:99-100
Ruby/shell backtick execution
2. **Fetch in parallel.** Run the adapters for the configured `platforms` (see *Adapters* below).
The runtime instructions tell the agent to run local Python adapters or pipeline scripts. The command text is in Markdown, but local command execution is part of the skill behavior.
Medium
SKILL.md:101-103
Ruby/shell backtick execution
3. **Normalize + dedup:** `python3 scripts/normalize.py <raw files...> -o signals.json`.
The runtime instructions tell the agent to run local Python adapters or pipeline scripts. The command text is in Markdown, but local command execution is part of the skill behavior.
Medium
SKILL.md:107-109
Ruby/shell backtick execution
5. **Rank:** `python3 scripts/rank.py signals.json -o ranked.json` (combines your fit score with
The runtime instructions tell the agent to run local Python adapters or pipeline scripts. The command text is in Markdown, but local command execution is part of the skill behavior.
Medium
SKILL.md:109-111
Ruby/shell backtick execution
6. **Select:** `python3 scripts/select.py ranked.json --n <opportunities_per_run> -o top.json`
The runtime instructions tell the agent to run local Python adapters or pipeline scripts. The command text is in Markdown, but local command execution is part of the skill behavior.
Medium
SKILL.md:119-122
Ruby/shell backtick execution
8. **Digest:** `python3 scripts/digest.py top.json --angles angles.json -o digest.md` using
The runtime instructions tell the agent to run local Python adapters or pipeline scripts. The command text is in Markdown, but local command execution is part of the skill behavior.
Medium
SKILL.md:125-128
Ruby/shell backtick execution
9. **Watchlist pass:** `python3 scripts/watchlist_tally.py --config config.json --run top.json`.
The runtime instructions tell the agent to run local Python adapters or pipeline scripts. The command text is in Markdown, but local command execution is part of the skill behavior.
Medium
SKILL.md:138-148
Ruby/shell backtick execution
update or remove the routine via `/schedule` so config and routine stay in sync
The skill instructs the agent to update or remove a scheduled routine through /schedule. That creates persistent automation and is a real tool-execution risk.
Medium
SKILL.md:148
Ruby/shell backtick execution
`./setup update` from the skill directory (`git pull --ff-only` + dependency re-check), then
The skill instructs update commands that run setup or git pull from the skill directory. This is intended maintenance behavior but executes external commands and network-backed updates.
Medium
SKILL.md:149-150
Ruby/shell backtick execution
summarize the new commits for the user. Equivalent: `cd <skill-dir> && git pull --ff-only`. Tell
The skill instructs update commands that run setup or git pull from the skill directory. This is intended maintenance behavior but executes external commands and network-backed updates.
Medium
SKILL.md:150-158
Ruby/shell backtick execution
the user if a `git pull` can't fast-forward (local edits) rather than forcing it.
The skill instructs update commands that run setup or git pull from the skill directory. This is intended maintenance behavior but executes external commands and network-backed updates.
Medium
SKILL.md:247
Ruby/shell backtick execution
Run only the adapters in `config.platforms`. Each emits `OpportunitySignal` JSON to a file.
The runtime instructions tell the agent to run local Python adapters or pipeline scripts. The command text is in Markdown, but local command execution is part of the skill behavior.
Medium
SKILL.md:251
Ruby/shell backtick execution
| Reddit | Apify `trudax/reddit-scraper-lite` (no login, same token) | Free official OAuth API (`--p
The runtime instructions tell the agent to run local Python adapters or pipeline scripts. The command text is in Markdown, but local command execution is part of the skill behavior.
Medium
SKILL.md:252
Ruby/shell backtick execution
| LinkedIn | Apify **cookieless** actor (`apimaestro/...no-cookies`) | `harvestapi/linkedin-post-sea
The runtime instructions tell the agent to run local Python adapters or pipeline scripts. The command text is in Markdown, but local command execution is part of the skill behavior.
Medium
SKILL.md:253-255
Ruby/shell backtick execution
| X (optional) | Apify X actor | — | `python3 scripts/adapters/x_adapter.py --config config.json -o
The runtime instructions tell the agent to run local Python adapters or pipeline scripts. The command text is in Markdown, but local command execution is part of the skill behavior.
Medium
SKILL.md:202
Hidden file access
✓ ~/.config/delta-engage/config.json — your profile & settings
The line creates or reads persistent user config, scheduled-task, or cross-skill state under a hidden home-directory path. This is expected state storage but still a real persistence and privacy risk.
Medium
SKILL.md:270
Hidden file access
- **Per-user skill config:** `~/.config/delta-engage/config.json` (created during onboarding).
The line creates or reads persistent user config, scheduled-task, or cross-skill state under a hidden home-directory path. This is expected state storage but still a real persistence and privacy risk.
Medium
SKILL.md:273
Hidden file access
- **Shared cross-skill promo state (`vof_status`):** `~/.config/delta-skills/shared-state.json`.
The line creates or reads persistent user config, scheduled-task, or cross-skill state under a hidden home-directory path. This is expected state storage but still a real persistence and privacy risk.
Medium
SKILL.md:277
Hidden file access
If `~/.config/delta-engage/config.json` is missing, treat it as first run → onboard.
The line creates or reads persistent user config, scheduled-task, or cross-skill state under a hidden home-directory path. This is expected state storage but still a real persistence and privacy risk.
Low
scripts/adapters/linkedin_adapter.py:77
Python HTTP libraries
run = requests.post(
The adapter makes outbound HTTP requests to Apify or Reddit endpoints and passes user topics, profile URLs, or API credentials. This is intended behavior but is real external network activity.
Low
scripts/adapters/linkedin_adapter.py:86
Python HTTP libraries
st = requests.get(f"https://api.apify.com/v2/actor-runs/{run_id}",
The adapter makes outbound HTTP requests to Apify or Reddit endpoints and passes user topics, profile URLs, or API credentials. This is intended behavior but is real external network activity.
Low
scripts/adapters/linkedin_adapter.py:93
Python HTTP libraries
return requests.get(f"https://api.apify.com/v2/datasets/{st['defaultDatasetId']}/items",
The adapter makes outbound HTTP requests to Apify or Reddit endpoints and passes user topics, profile URLs, or API credentials. This is intended behavior but is real external network activity.
Low
scripts/adapters/linkedin_adapter.py:78
Hardcoded URL
f"https://api.apify.com/v2/acts/{actor}/runs",
The adapter makes outbound HTTP requests to Apify or Reddit endpoints and passes user topics, profile URLs, or API credentials. This is intended behavior but is real external network activity.
Low
scripts/adapters/linkedin_adapter.py:86
Hardcoded URL
st = requests.get(f"https://api.apify.com/v2/actor-runs/{run_id}",
The adapter makes outbound HTTP requests to Apify or Reddit endpoints and passes user topics, profile URLs, or API credentials. This is intended behavior but is real external network activity.
Low
scripts/adapters/linkedin_adapter.py:93
Hardcoded URL
return requests.get(f"https://api.apify.com/v2/datasets/{st['defaultDatasetId']}/items",
The adapter makes outbound HTTP requests to Apify or Reddit endpoints and passes user topics, profile URLs, or API credentials. This is intended behavior but is real external network activity.
Low
scripts/adapters/linkedin_adapter.py:34
Python environment access
APIFY_COOKIELESS_ACTOR = os.environ.get(
The code reads environment variables to select external provider actors or settings paths. This is legitimate configuration, but environment-controlled behavior affects external data access.
Low
scripts/adapters/linkedin_adapter.py:39
Python environment access
APIFY_PROFILE_ACTOR = os.environ.get(
The code reads environment variables to select external provider actors or settings paths. This is legitimate configuration, but environment-controlled behavior affects external data access.
Low
scripts/adapters/linkedin_adapter.py:244
Python environment access
token = os.environ.get("APIFY_API_TOKEN")
The code reads API tokens or OAuth secrets from environment variables and uses them for provider access. That is expected BYOK behavior but still touches credentials.
Low
scripts/adapters/reddit_adapter.py:66
Python HTTP libraries
run = requests.post(
The adapter makes outbound HTTP requests to Apify or Reddit endpoints and passes user topics, profile URLs, or API credentials. This is intended behavior but is real external network activity.
Low
scripts/adapters/reddit_adapter.py:75
Python HTTP libraries
st = requests.get(f"https://api.apify.com/v2/actor-runs/{run_id}",
The adapter makes outbound HTTP requests to Apify or Reddit endpoints and passes user topics, profile URLs, or API credentials. This is intended behavior but is real external network activity.
Low
scripts/adapters/reddit_adapter.py:81
Python HTTP libraries
items = requests.get(f"https://api.apify.com/v2/datasets/{st['defaultDatasetId']}/items",
The adapter makes outbound HTTP requests to Apify or Reddit endpoints and passes user topics, profile URLs, or API credentials. This is intended behavior but is real external network activity.
Low
scripts/adapters/reddit_adapter.py:124
Python HTTP libraries
resp = requests.post(
The adapter makes outbound HTTP requests to Apify or Reddit endpoints and passes user topics, profile URLs, or API credentials. This is intended behavior but is real external network activity.
Low
scripts/adapters/reddit_adapter.py:169
Python HTTP libraries
r = requests.get(f"https://oauth.reddit.com/r/{sub}/top", headers=headers,
The adapter makes outbound HTTP requests to Apify or Reddit endpoints and passes user topics, profile URLs, or API credentials. This is intended behavior but is real external network activity.
Low
scripts/adapters/reddit_adapter.py:177
Python HTTP libraries
r = requests.get(f"https://oauth.reddit.com/r/{sub}/search", headers=headers,
The adapter makes outbound HTTP requests to Apify or Reddit endpoints and passes user topics, profile URLs, or API credentials. This is intended behavior but is real external network activity.
Low
scripts/adapters/reddit_adapter.py:33
Hardcoded URL
OAUTH_TOKEN_URL = "https://www.reddit.com/api/v1/access_token"
The adapter makes outbound HTTP requests to Apify or Reddit endpoints and passes user topics, profile URLs, or API credentials. This is intended behavior but is real external network activity.
Low
scripts/adapters/reddit_adapter.py:50
Hardcoded URL
start_urls = [f"https://www.reddit.com/r/{s.strip().lstrip('r/').strip('/')}/top/?t={time_filter}"
The adapter makes outbound HTTP requests to Apify or Reddit endpoints and passes user topics, profile URLs, or API credentials. This is intended behavior but is real external network activity.
Low
scripts/adapters/reddit_adapter.py:67
Hardcoded URL
f"https://api.apify.com/v2/acts/{APIFY_REDDIT_ACTOR}/runs",
The adapter makes outbound HTTP requests to Apify or Reddit endpoints and passes user topics, profile URLs, or API credentials. This is intended behavior but is real external network activity.
Low
scripts/adapters/reddit_adapter.py:75
Hardcoded URL
st = requests.get(f"https://api.apify.com/v2/actor-runs/{run_id}",
The adapter makes outbound HTTP requests to Apify or Reddit endpoints and passes user topics, profile URLs, or API credentials. This is intended behavior but is real external network activity.
Low
scripts/adapters/reddit_adapter.py:81
Hardcoded URL
items = requests.get(f"https://api.apify.com/v2/datasets/{st['defaultDatasetId']}/items",
The adapter makes outbound HTTP requests to Apify or Reddit endpoints and passes user topics, profile URLs, or API credentials. This is intended behavior but is real external network activity.
Low
scripts/adapters/reddit_adapter.py:169
Hardcoded URL
r = requests.get(f"https://oauth.reddit.com/r/{sub}/top", headers=headers,
The adapter makes outbound HTTP requests to Apify or Reddit endpoints and passes user topics, profile URLs, or API credentials. This is intended behavior but is real external network activity.
Low
scripts/adapters/reddit_adapter.py:177
Hardcoded URL
r = requests.get(f"https://oauth.reddit.com/r/{sub}/search", headers=headers,
The adapter makes outbound HTTP requests to Apify or Reddit endpoints and passes user topics, profile URLs, or API credentials. This is intended behavior but is real external network activity.
Low
scripts/adapters/reddit_adapter.py:36
Python environment access
APIFY_REDDIT_ACTOR = os.environ.get("DELTA_ENGAGE_REDDIT_ACTOR", "trudax~reddit-scraper-lite")
The code reads environment variables to select external provider actors or settings paths. This is legitimate configuration, but environment-controlled behavior affects external data access.
Low
scripts/adapters/reddit_adapter.py:214
Python environment access
cid, csecret = os.environ.get("REDDIT_CLIENT_ID"), os.environ.get("REDDIT_CLIENT_SECRET")
The code reads API tokens or OAuth secrets from environment variables and uses them for provider access. That is expected BYOK behavior but still touches credentials.
Low
scripts/adapters/reddit_adapter.py:224
Python environment access
token = os.environ.get("APIFY_API_TOKEN")
The code reads API tokens or OAuth secrets from environment variables and uses them for provider access. That is expected BYOK behavior but still touches credentials.
Low
scripts/adapters/x_adapter.py:42
Python HTTP libraries
run = requests.post(
The adapter makes outbound HTTP requests to Apify or Reddit endpoints and passes user topics, profile URLs, or API credentials. This is intended behavior but is real external network activity.
Low
scripts/adapters/x_adapter.py:51
Python HTTP libraries
st = requests.get(f"https://api.apify.com/v2/actor-runs/{run_id}",
The adapter makes outbound HTTP requests to Apify or Reddit endpoints and passes user topics, profile URLs, or API credentials. This is intended behavior but is real external network activity.
Low
scripts/adapters/x_adapter.py:56
Python HTTP libraries
items = requests.get(f"https://api.apify.com/v2/datasets/{ds_id}/items",
The adapter makes outbound HTTP requests to Apify or Reddit endpoints and passes user topics, profile URLs, or API credentials. This is intended behavior but is real external network activity.
Low
scripts/adapters/x_adapter.py:43
Hardcoded URL
f"https://api.apify.com/v2/acts/{APIFY_X_ACTOR}/runs",
The adapter makes outbound HTTP requests to Apify or Reddit endpoints and passes user topics, profile URLs, or API credentials. This is intended behavior but is real external network activity.
Low
scripts/adapters/x_adapter.py:51
Hardcoded URL
st = requests.get(f"https://api.apify.com/v2/actor-runs/{run_id}",
The adapter makes outbound HTTP requests to Apify or Reddit endpoints and passes user topics, profile URLs, or API credentials. This is intended behavior but is real external network activity.
Low
scripts/adapters/x_adapter.py:56
Hardcoded URL
items = requests.get(f"https://api.apify.com/v2/datasets/{ds_id}/items",
The adapter makes outbound HTTP requests to Apify or Reddit endpoints and passes user topics, profile URLs, or API credentials. This is intended behavior but is real external network activity.
Low
scripts/adapters/x_adapter.py:24
Python environment access
APIFY_X_ACTOR = os.environ.get("DELTA_ENGAGE_X_ACTOR", "apidojo~tweet-scraper")
The code reads environment variables to select external provider actors or settings paths. This is legitimate configuration, but environment-controlled behavior affects external data access.
Low
scripts/adapters/x_adapter.py:97
Python environment access
token = os.environ.get("APIFY_API_TOKEN")
The code reads API tokens or OAuth secrets from environment variables and uses them for provider access. That is expected BYOK behavior but still touches credentials.
Low
setup:64
Python environment access
p = os.environ["SETTINGS_PATH"]
The code reads environment variables to select external provider actors or settings paths. This is legitimate configuration, but environment-controlled behavior affects external data access.
Low
setup:70
Python environment access
cfg.setdefault("env", {})["APIFY_API_TOKEN"] = os.environ["APIFY_TOKEN"]
The code reads API tokens or OAuth secrets from environment variables and uses them for provider access. That is expected BYOK behavior but still touches credentials.

Risk Factors

🌐 Network access (37)
assets/config.schema.json:2 README.md:108 README.md:42 README.md:55 README.md:69 README.md:85 scripts/adapters/linkedin_adapter.py:77 scripts/adapters/linkedin_adapter.py:86 scripts/adapters/linkedin_adapter.py:93 scripts/adapters/linkedin_adapter.py:16 scripts/adapters/linkedin_adapter.py:78 scripts/adapters/linkedin_adapter.py:86 scripts/adapters/linkedin_adapter.py:93 scripts/adapters/reddit_adapter.py:66 scripts/adapters/reddit_adapter.py:75 scripts/adapters/reddit_adapter.py:81 scripts/adapters/reddit_adapter.py:124 scripts/adapters/reddit_adapter.py:169 scripts/adapters/reddit_adapter.py:177 scripts/adapters/reddit_adapter.py:8 scripts/adapters/reddit_adapter.py:33 scripts/adapters/reddit_adapter.py:50 scripts/adapters/reddit_adapter.py:67 scripts/adapters/reddit_adapter.py:75 scripts/adapters/reddit_adapter.py:81 scripts/adapters/reddit_adapter.py:151 scripts/adapters/reddit_adapter.py:153 scripts/adapters/reddit_adapter.py:169 scripts/adapters/reddit_adapter.py:177 scripts/adapters/reddit_adapter.py:217 scripts/adapters/x_adapter.py:42 scripts/adapters/x_adapter.py:51 scripts/adapters/x_adapter.py:56 scripts/adapters/x_adapter.py:43 scripts/adapters/x_adapter.py:51 scripts/adapters/x_adapter.py:56 setup:54
📁 Filesystem access (57)
README.md:85 README.md:132 README.md:139 README.md:85 README.md:132 README.md:139 references/DECISIONS.md:152 references/DECISIONS.md:172 references/DECISIONS.md:152 references/DECISIONS.md:172 references/delivery.md:7 references/delivery.md:34 references/delivery.md:39 references/delivery.md:7 references/delivery.md:34 references/delivery.md:39 references/onboarding.md:220 references/onboarding.md:136 references/onboarding.md:142 references/onboarding.md:216 references/onboarding.md:136 references/onboarding.md:142 references/onboarding.md:216 references/onboarding.md:79 references/voizer-flow.md:13 references/voizer-flow.md:13 scripts/adapters/linkedin_adapter.py:255 scripts/adapters/reddit_adapter.py:233 scripts/adapters/x_adapter.py:93 scripts/adapters/x_adapter.py:103 scripts/digest.py:123 scripts/normalize.py:123 scripts/rank.py:92 scripts/select.py:78 scripts/watchlist_tally.py:132 setup:48 setup:9 setup:48 setup:17 setup:19 setup:22 setup:34 setup:39 setup:57 setup:59 setup:71 setup:65 SKILL.md:39 SKILL.md:202 SKILL.md:270 SKILL.md:273 SKILL.md:277 SKILL.md:39 SKILL.md:202 SKILL.md:270 SKILL.md:273 SKILL.md:277
⚙️ External commands (62)
scripts/adapters/linkedin_adapter.py:135 scripts/rank.py:5 setup:8 setup:17 setup:19 setup:35 SKILL.md:33 SKILL.md:38 SKILL.md:39 SKILL.md:40 SKILL.md:46 SKILL.md:47 SKILL.md:50 SKILL.md:57-73 SKILL.md:73-84 SKILL.md:84-94 SKILL.md:94-96 SKILL.md:96-99 SKILL.md:99-100 SKILL.md:100-101 SKILL.md:101-103 SKILL.md:103 SKILL.md:104 SKILL.md:106 SKILL.md:107-109 SKILL.md:109-111 SKILL.md:111-113 SKILL.md:113-117 SKILL.md:117 SKILL.md:119-122 SKILL.md:122-125 SKILL.md:125-128 SKILL.md:128-129 SKILL.md:129 SKILL.md:131-132 SKILL.md:132-135 SKILL.md:135-138 SKILL.md:138-148 SKILL.md:148 SKILL.md:149-150 SKILL.md:150-158 SKILL.md:158-159 SKILL.md:159 SKILL.md:163-166 SKILL.md:166 SKILL.md:174-209 SKILL.md:209-214 SKILL.md:214-222 SKILL.md:222-238 SKILL.md:238-239 SKILL.md:239-247 SKILL.md:247 SKILL.md:251 SKILL.md:252 SKILL.md:253-255 SKILL.md:255-256 SKILL.md:256-257 SKILL.md:257 SKILL.md:259 SKILL.md:260-270 SKILL.md:270-273 SKILL.md:273
🔑 Env variables (14)
scripts/adapters/linkedin_adapter.py:34 scripts/adapters/linkedin_adapter.py:39 scripts/adapters/linkedin_adapter.py:244 scripts/adapters/reddit_adapter.py:36 scripts/adapters/reddit_adapter.py:214 scripts/adapters/reddit_adapter.py:224 scripts/adapters/x_adapter.py:24 scripts/adapters/x_adapter.py:97 scripts/watchlist_tally.py:43 scripts/watchlist_tally.py:59 scripts/watchlist_tally.py:78 scripts/watchlist_tally.py:104 setup:64 setup:70
Audited by: codex View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/newan2001-delta-engage/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/newan2001-delta-engage/security.svg)](https://skillstore.io/skills/newan2001-delta-engage?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/newan2001-delta-engage?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/newan2001-delta-engage/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/newan2001-delta-engage.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

newan2001. (2026). delta-engage security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/newan2001-delta-engage/audits/4

BibTeX citation

@techreport{newan2001-newan2001-delta-engage-2026, author = {newan2001}, title = {delta-engage security audit report (audit version 4)}, institution = {Skillstore}, year = {2026}, number = {4}, url = {https://skillstore.io/skills/newan2001-delta-engage/audits/4}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "delta-engage security audit report (audit version 4)" version: "unspecified" type: report authors: - name: "newan2001" date-released: "2026-07-05" url: "https://skillstore.io/skills/newan2001-delta-engage/audits/4" identifiers: - type: other value: "skillstore:newan2001-delta-engage:audit:4" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium
95
Architecture
85
Maintainability
87
Content
65
Community
83
Spec Compliance

What You Can Build

Build Founder Presence

Find timely posts from buyers, peers, and opinion leaders, then prepare thoughtful replies for manual engagement.

Support Social Selling

Identify buyer pain conversations and prepare non-pitch comment drafts that can start useful conversations.

Run Community Listening

Monitor Reddit and LinkedIn for customer language, repeated objections, and voices worth tracking over time.

Try These Prompts

Start My First Run 
Run delta-engage for me. Help me set up my profile, choose Reddit and LinkedIn sources, and show the first digest in chat.
Find Buyer Conversations 
Find posts from people who match my ICP and are describing the pain I solve. Separate buyers from peers and competitors.
Improve Draft Quality 
Use my confirmed voice profile and Reddit safety rules. Draft comments that are specific, low-promotion, and ready for my edits.
Review Watchlist Signals 
Run my engagement routine, summarize recurring authors, and propose watchlist changes without applying them until I confirm.

Best Practices

  • Review each draft before posting and add your own context or lived experience.
  • Keep API tokens in approved local settings and avoid pasting secrets into shared logs.
  • Use pain-language topics, not service-category keywords, to reduce competitor-heavy results.

Avoid

  • Do not paste generated replies verbatim across multiple posts or communities.
  • Do not use cookie-based LinkedIn actors or session credentials with this skill.
  • Do not treat peer or competitor posts as buyer leads.

Frequently Asked Questions

Does this skill post comments for me?
No. It prepares drafts and digests. You edit and post manually from your own accounts.
Which platforms does it support?
It supports Reddit and LinkedIn by default. X is optional and off unless configured.
What credentials are required?
The default adapters need an Apify API token. The optional Reddit official path needs Reddit OAuth credentials.
Where is my engagement profile stored?
The skill stores profile settings in a local delta-engage config file under the user config directory.
Can it send digests to Slack or Notion?
Yes, if those integrations are available. Otherwise it falls back to in-app delivery.
Is the LinkedIn adapter logged in?
No. The documented LinkedIn path uses public cookieless actors and rejects cookie-style inputs.

Developer Details

Author

newan2001

License

MIT

Skillstore revision

r1

Version notice

The author did not declare a version.

Repository

https://github.com/newan2001/delta-engage/tree/main/

Ref

62e2a730c5cd74eab4c7164309d810de660fcea3

Maintenance freshness

7/18/2026

Usage

1 downloads · 0 views

File structure

📁 assets/

📄 config.schema.json

📄 digest_template.md

📁 references/

📄 angles.md

📄 DECISIONS.md

📄 delivery.md

📄 onboarding.md

📄 ranking.md

📄 reddit-safety.md

📄 voizer-flow.md

📄 watchlist.md

📁 scripts/

📁 adapters/

📄 linkedin_adapter.py

📄 reddit_adapter.py

📄 x_adapter.py

📁 lib/

📄 opportunity_signal.py

📄 digest.py

📄 normalize.py

📄 rank.py

📄 select.py

📄 watchlist_tally.py

📄 LICENSE

📄 README.md

📄 requirements.txt

📄 setup

📄 SKILL.md