
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
@mysocial.io/intelligence
Advanced tools
Install and connect mySocial Intelligence for Claude Code and Codex.
Use your mySocial social media intelligence in Claude Code or Codex.
Run the command shown by mySocial onboarding:
npx -y @mysocial.io/intelligence@latest setup --session <one-time-code>
The installer detects Claude Code and Codex, installs for the current user by default, opens the client's OAuth flow, and prints the first prompt to run. If both clients are available, select one interactively or pass --client claude / --client codex.
mysocial-intelligence status
mysocial-intelligence repair
mysocial-intelligence uninstall
Useful options:
--scope project installs the agent and skills in the current project instead of user directories.--base-url https://example.mysocial.io overrides the current https://app.mysocial.io service. It takes precedence over MYSOCIAL_SETUP_API_URL.--no-telemetry is accepted for automation and policy compliance. This release sends no optional telemetry.| Client | User scope | Project scope |
|---|---|---|
| Claude agent | ~/.claude/agents/mysocial-intelligence.md | .claude/agents/mysocial-intelligence.md |
| Claude skills | ~/.claude/skills/{skill}/ | .claude/skills/{skill}/ |
| Codex agent | ~/.codex/agents/mysocial-intelligence.toml | .codex/agents/mysocial-intelligence.toml |
| Codex skills | ~/.agents/skills/{skill}/ | .agents/skills/{skill}/ |
Claude MCP registration uses its native scoped commands. User-scoped Codex registration uses codex mcp add. Because the Codex CLI has no project-scope flag, project setup atomically adds a marker-delimited [mcp_servers.mysocial] block to .codex/config.toml; it never changes the user's global Codex MCP configuration.
Codex exposes codex mcp login mysocial for OAuth. Current Claude Code completes remote MCP OAuth inside its interactive /mcp panel, so the installer offers to open Claude Code and explains the two choices to make there. If a future Claude release exposes a native mcp login command, the installer detects and uses it automatically. For the interactive Claude path, the CLI deliberately does not report OAuth success; mySocial advances only when it observes real authenticated MCP traffic.
An ownership manifest is stored at ~/.mysocial/intelligence/manifest.json or .mysocial/intelligence/manifest.json. Every managed file has a SHA-256 checksum. Repair only replaces a file when its checksum proves mySocial owns the current bytes. Uninstall preserves pre-existing and user-modified files and only removes an MCP registration that the manifest says mySocial created and that still points to the installed URL.
When --session is present, the CLI calls:
GET <base-url>/api/intelligence/setup/v1/session
PATCH <base-url>/api/intelligence/setup/v1/session
Authorization: Setup <one-time-secret>
The GET response may use either a flat shape or a session envelope and supplies the expiry, selected/permitted clients, and MCP URL:
{
"session": {
"expiresAt": "2026-07-22T12:00:00.000Z",
"selectedClient": "codex",
"allowedClients": ["claude-code", "codex"]
},
"mcp": { "url": "https://app.mysocial.io/mcp" }
}
Progress PATCHes contain only phase, client, installerVersion, and, on failure, a safe errorCode. Allowed phases are client_selected, assets_installed, oauth_started, oauth_connected, awaiting_test, and failed. The CLI cannot report onboarding completion or MCP verification. Only the server's successful authenticated list_channels observation can verify an MCP connection; the browser may separately skip the optional AI step after the required social channel is connected.
The setup secret is used only in the HTTP authorization header. It is never written to disk, passed to a child process, included in output, or sent as telemetry. Functional setup progress is sent only when a setup session is explicitly supplied.
The canonical workflow skills live under services/connect-api/ssr/features/feature-mcp/skills. (services/webapp holds the pre-split copy and no longer receives changes.) Keep the package copies current with:
npm run sync:assets
npm test
npm pack --dry-run
The package is configured for public npm access and provenance. Publishing still requires an authorized @mysocial npm scope and a provenance-capable CI environment.
FAQs

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.