langchain-ai/social-media-agent

Review signals: 2 encoded blob, 9 hardcoded secret, 35 known vulnerability, 1 outside write.

Reviewed as expected for a test run: npm looked for a config file that did not exist, so nothing was read.

Source contains encoded blob; review its purpose. 2 distinct locations. 2 findings.

Gitleaks found a possible hardcoded secret; value withheld. 7 distinct locations. 8 findings.

OSV reports a known vulnerability in this dependency version. 13 distinct locations. 35 findings.

Repository processes attempted these writes outside documented output/cache paths. 3 distinct locations. 3 attributed processes.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• The LangGraph server starts with the documented script and serves the registered graphs: Real input produced the expected result: curated_post_interrupt

  Source: To start the LangGraph server, run this script:

  Input: GET assistant e4ac3461-519e-5766-967f-68a84d44fdc6 after yarn langgraph:in_mem:up

  Expected: assistant record for the curated_post_interrupt graph

  Command: yarn langgraph:in_mem:up

  Observed: curated_post_interrupt","metadata":{"created_by":"system"},"name":"curated_post_interrupt","description":null}

• Generating a post through the running server requires API keys that were not available here: yarn generate_post needs ANTHROPIC_API_KEY and FIRECRAWL_API_KEY (plus ARCADE_API_KEY for the quickstart); none were supplied, so no post was generated.

  Source: Once the server is ready, you can execute the following command to generate a post:

  Observed: yarn generate_post needs ANTHROPIC_API_KEY and FIRECRAWL_API_KEY (plus ARCADE_API_KEY for the quickstart); none were supplied, so no post was generated.

Examples

• Repository's documented offline unit test suite runs: command completed successfully

  Source: package.json scripts.test

  Input: yarn test (jest, *.test.ts, excludes *.int.test.ts)

  Expected: all unit test suites pass

  Command: yarn -s test

  Observed: ^ 3 | 4 | // Mock the timezone to 'America/Los_Angeles' 5 | // timezoneMock.register("US/Pacific"); // Alternatively, use 'America/Los_Angeles' at ie (node_modules/dotenv/dist/index.cjs:7:155) at Object.ae [as configDotenv] (node_modules/dotenv/dist/index.cjs:7:1128) at Object.le [as config] (node_modules/dotenv/dist/index.cjs:7:1237) at Object.<anonymous> (jest.setup.cjs:2:19) Test Suites: 6 passed, 6 total Tests: 4 skipped, 71 passed, 75 total Snapshots: 0 total Time: 15.52 s Ran all test suites matching .test.ts$.

Cycles

• Scheduled ingest_data cron runs daily at 08:00 UTC: Cron search on the in-memory dev server returns 'Not implemented' (yarn cron:list against http://localhost:54367). Cron scheduling needs a deployed LangGraph server, and the create-cron script still has the placeholder slackChannelId ADD_SLACK_CHANNEL_ID_HERE plus a SLACK_BOT_TOKEN, so no cycle was run.

  Source: scripts/crons/create-cron.ts

  Input: no trigger was run; the local in-memory dev server cannot run crons

  Expected: ingest_data run started by the cron scheduler

  Observed: Cron search on the in-memory dev server returns 'Not implemented' (yarn cron:list against http://localhost:54367). Cron scheduling needs a deployed LangGraph server, and the create-cron script still has the placeholder slackChannelId ADD_SLACK_CHANNEL_ID_HERE plus a SLACK_BOT_TOKEN, so no cycle was run.

Local or hosted: local

Start the LangGraph server with `yarn langgraph:in_mem:up` and call its API (read back the curated_post_interrupt assistant); run the documented unit tests with `yarn test`.

cd <guest-path> && ls -la && cat README.md | head -300 && python3 --version && id -u && git status 2>&1 | head -3
cd <guest-path> && git init -q 2>&1; git remote add origin https://github.com/langchain-ai/social-media-agent.git && git fetch --depth 1 origin 7c98af38daaa6b2d721dfcdd2307f3acabd7aa60 2>&1 | tail -3; git reset --mixed FETCH_HEAD 2>&1 | tail -2; git log --oneline | head -2; git status --short | head; echo ---; sed -n 300,500p README.md | grep -n -i -E "cron|yarn|npm|node|python|docker" | head -60; echo ---; cat package.json | head -60; node --version; npm --version; yarn --version; sudo -n true && echo SUDO_OK
cd <guest-path> && grep -n -i -E "node|engines" README.md package.json | head; grep -n -A3 '"engines"' package.json; cat .env.quickstart.example; cat /etc/os-release | head -2; (sudo apt-get update -qq && sudo DEBIAN_FRONTEND=noninteractive apt-get install -y -qq nodejs npm >/tmp/apt.log 2>&1; echo apt=$?); node --version; npm --version
export NODE_USE_ENV_PROXY=1; cd /tmp && curl -fsSL https://deb.nodesource.com/setup_22.x -o /tmp/ns.sh && sudo -E bash /tmp/ns.sh >/tmp/ns.log 2>&1; echo ns=$?; sudo DEBIAN_FRONTEND=noninteractive apt-get install -y -qq nodejs >/tmp/apt2.log 2>&1; echo apt=$?; node --version; sudo npm i -g [email protected] >/tmp/yarn.log 2>&1; echo yarn=$?; yarn --version; tail -3 /tmp/ns.log /tmp/apt2.log 2>/dev/null | tail -8
export NODE_USE_ENV_PROXY=1; cd <guest-path> && yarn install --frozen-lockfile > /tmp/yarn-install.log 2>&1; echo rc=$?; tail -15 /tmp/yarn-install.log
cd <guest-path> && cp .env.quickstart.example .env && ls .coldpass; (nohup yarn langgraph:in_mem:up > /tmp/lg.log 2>&1 &); sleep 90; tail -30 /tmp/lg.log
cd <guest-path> && curl -s -m 10 http://localhost:54367/ok; echo; curl -s -m 10 -X POST http://localhost:54367/assistants/search -H 'content-type: application/json' -d '{"limit":20}' | head -c 1500; echo; curl -s -m 10 -X POST http://localhost:54367/threads -H 'content-type: application/json' -d '{}' | head -c 300; echo; cat scripts/generate-post.ts | head -60
ls <guest-path> /inputs 2>&1; f=<guest-path>; wc -l $f; grep -n -E "stays_running|method|'http'|\"http\"|kind ==|expected_file|needs_credentials|credentials_error" $f | head -60
f=<guest-path>; sed -n 250,270p $f; sed -n 810,845p $f; grep -n -A12 "^def http_details" $f | head -40
f=<guest-path>; grep -n "^def http(" $f; n=$(grep -n "^def http(" $f | cut -d: -f1); sed -n "${n},$((n+30))p" $f
cd <guest-path> && curl -s -m 10 http://localhost:54367/assistants/e4ac3461-519e-5766-967f-68a84d44fdc6 | head -c 400; echo; curl -s -m 10 http://localhost:54367/assistants/e4ac3461-519e-5766-967f-68a84d44fdc6 | grep -o '"graph_id":"[^"]*"'; echo ---; f=<guest-path>; sed -n 861,900p $f | cut -c1-220; echo ---; ls scripts/crons; sed -n 1,60p scripts/crons/create-cron.ts | cut -c1-200
cd <guest-path> && export NODE_USE_ENV_PROXY=1; LANGGRAPH_API_URL=http://localhost:54367 timeout 170 yarn -s cron:list 2>&1 | tail -15; echo rc=$?; curl -s -m 10 -X POST http://localhost:54367/runs/crons/search -H 'content-type: application/json' -d '{}' ; echo; curl -s -m 10 -X POST http://localhost:54367/runs/crons -H 'content-type: application/json' -d '{}' | head -c 300; echo; cat scripts/crons/list-crons.ts | head -30 | cut -c1-160
pkill -f "langgraph-cli" ; pkill -f "langgraph:in_mem" ; pkill -f "langgraph dev"; sleep 3; (ss -ltnp 2>/dev/null | grep 54367) ; echo "port-check-done"; cd <guest-path> && export NODE_USE_ENV_PROXY=1 && timeout 900 yarn -s test > /tmp/yarn-test.log 2>&1; echo testrc=$?; grep -E "^(Tests|Test Suites):" /tmp/yarn-test.log; tail -5 /tmp/yarn-test.log
for p in $(pgrep -f "in_mem:up|langgraph-cli dev" ); do echo pid $p; done | head; for p in $(pgrep -f "langgraph-cli dev|in_mem:up" | grep -v "^$"); do kill $p 2>/dev/null; done; sleep 3; curl -s -m 3 http://localhost:54367/ok || echo "server down"; pgrep -fa "langgraph" | grep -v pgrep | head -5
ps -eo pid,args | grep '[l]anggraph' | head; for p in $(ps -eo pid,args | grep '[l]anggraph' | awk '{print $1}'); do kill $p 2>/dev/null; done; sleep 3; curl -s -m 3 http://localhost:54367/ok || echo "server down"
cd <guest-path> && export NODE_USE_ENV_PROXY=1 && timeout 900 yarn -s test > /tmp/yarn-test.log 2>&1; echo testrc=$?; grep -E "^(Tests|Test Suites):" /tmp/yarn-test.log; tail -4 /tmp/yarn-test.log
cd <guest-path> && mkdir -p .coldpass && python3 -I - <<'EOF'
import json
W="<guest-path>"
URL="http://localhost:54367/assistants/e4ac3461-519e-5766-967f-68a84d44fdc6"
server=["yarn","langgraph:in_mem:up"]
probe={"kind":"http","argv":server,"cwd":W,"url":URL,"expected_text":"curated_post_interrupt"}
claims=[
 {"kind":"claim","claim":"The LangGraph server starts with the documented script and serves the registered graphs",
  "source":"To start the LangGraph server, run this script:","input":"GET assistant e4ac3461-519e-5766-967f-68a84d44fdc6 after yarn langgraph:in_mem:up",
  "expected":"assistant record for the curated_post_interrupt graph","probe_kind":"http","argv":server,
  "url":URL,"expected_text":"curated_post_interrupt","cwd":W},
 {"kind":"claim","claim":"Generating a post through the running server requires API keys that were not available here",
  "source":"Once the server is ready, you can execute the following command to generate a post:","testable":False,
  "reason":"yarn generate_post needs ANTHROPIC_API_KEY and FIRECRAWL_API_KEY (plus ARCADE_API_KEY for the quickstart); none were supplied, so no post was generated."},
]
examples=[
 {"kind":"example","claim":"Repository's documented offline unit test suite runs",
  "source":"package.json scripts.test","input":"yarn test (jest, *.test.ts, excludes *.int.test.ts)",
  "expected":"all unit test suites pass","argv":["yarn","-s","test"],"cwd":W,"env":{}},
]
cycles={"detected":True,"checks":[
 {"claim":"Scheduled ingest_data cron runs daily at 08:00 UTC",
  "source":"scripts/crons/create-cron.ts",
  "quote":'schedule: "0 8 * * *", // Runs at 8:00 AM UTC every day (1AM PST)',
  "schedule":"0 8 * * * (daily 08:00 UTC)","method":"LangGraph cron API (crons.create) on the server",
  "input":"no trigger was run; the local in-memory dev server cannot run crons",
  "expected":"ingest_data run started by the cron scheduler",
  "reason":"Cron search on the in-memory dev server returns 'Not implemented' (yarn cron:list against http://localhost:54367). Cron scheduling needs a deployed LangGraph server, and the create-cron script still has the placeholder slackChannelId ADD_SLACK_CHANNEL_ID_HERE plus a SLACK_BOT_TOKEN, so no cycle was run."}
]}
for name,obj in [("probe.json",probe),("claims.json",claims),("examples.json",examples),("cycles.json",cycles)]:
    with open(f".coldpass/{name}","w") as f: json.dump(obj,f,indent=2)
print("ok")
EOF
ls -la .coldpass
cd <guest-path> && python3 -I - <<'EOF'
import json
report={
 "outcome":"needs_credentials",
 "fault_owner":"prerequisite",
 "operation":"Start the LangGraph server with `yarn langgraph:in_mem:up` and call its API (read back the curated_post_interrupt assistant); run the documented unit tests with `yarn test`.",
 "operation_scope":"Local in-memory LangGraph dev server on port 54367. Post generation (`yarn generate_post`) was NOT run: it needs ANTHROPIC_API_KEY and FIRECRAWL_API_KEY (and ARCADE_API_KEY for the quickstart), none of which were available. Cron scheduling was not run either.",
 "steps":[
  "git init; git remote add origin https://github.com/langchain-ai/social-media-agent.git; git fetch --depth 1 origin 7c98af38daaa6b2d721dfcdd2307f3acabd7aa60; git reset --mixed FETCH_HEAD",
  "Install Node 22 (nodesource setup_22.x, then apt install nodejs) and yarn 1.22.22 (npm i -g [email protected])",
  "yarn install --frozen-lockfile",
  "cp .env.quickstart.example .env",
  "yarn langgraph:in_mem:up",
  "yarn generate_post (not run: missing API keys)",
  "yarn test"
 ],
 "deviations":[
  "README gives no Node version. Distro Node 18 was installed first, but @types/node ^26 and the toolchain need a newer Node, so Node 22.23.4 was installed from nodesource (curl | sh of setup_22.x, run in the disposable guest).",
  "yarn was not installed; it was installed with npm i -g [email protected] to match package.json packageManager.",
  "Quickstart .env was created from .env.quickstart.example with blank keys. The LangSmith tracing 401 warning at server start is expected without LANGCHAIN_API_KEY.",
  "yarn generate_post was not run: no ANTHROPIC/FIRECRAWL/ARCADE keys were available, so no credentials were obtained.",
  "Cron scheduling was not run: `yarn cron:list` against the in-memory server returned 'Not implemented'; create-cron.ts also needs a Slack channel ID and token.",
  "Probe uses a read-back GET on the assistant record (its ID is stable) instead of a graph run, because the checker's http probe only does GET."
 ],
 "stuck_step":"yarn generate_post (README Quickstart 'Once the server is ready...') needs LLM and scraping API keys.",
 "main_blocker":"Missing API keys for Anthropic, FireCrawl and Arcade; the post-generation graph cannot run without them.",
 "plain_failure":"The app starts and serves its graphs locally, and its unit tests pass. Actually generating a social media post needs paid API keys that were not available in this test environment, so that step was not run.",
 "suggested_fix":"Supply ANTHROPIC_API_KEY, FIRECRAWL_API_KEY and ARCADE_API_KEY in .env (LANGCHAIN_API_KEY for tracing), then run `yarn langgraph:in_mem:up` and `yarn generate_post` to verify a full run. Consider stating the Node version (22+) in the README."
}
import os
os.makedirs(".coldpass",exist_ok=True)
json.dump(report,open(".coldpass/report.json","w"),indent=2)
print("written")
EOF
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -60
f=<guest-path>; sed -n 270,300p $f | cut -c1-240; grep -n "def replay\|'working'\] = \|working=" $f | head -20
f=<guest-path>; sed -n 1188,1202p $f | cut -c1-240; grep -n "^def scope_outcome\|scope_outcome(" $f | head
cd <guest-path> && curl -s -m 3 http://localhost:54367/ok || echo "54367 free"; ls report.json 2>/dev/null || echo "no root report.json"; ls -la .coldpass; python3 -I -c "import json;[json.load(open('.coldpass/'+f)) for f in ['probe.json','claims.json','examples.json','cycles.json','report.json']];print('json ok')"