The Agent Skills Directory

[SAFE]: The skill implements secure credential handling by using environment variables ($BLUESKY_HANDLE, $BLUESKY_APP_PASSWORD, $BLUESKY_SERVICE) and specifically instructing users to use App Passwords rather than primary account credentials. This follows the principle of least privilege for API access.- [SAFE]: Network operations are restricted to the Bluesky AT Protocol (XRPC) endpoints and user-provided image URLs required for the skill's functionality. The primary service bsky.social is a well-known service and the vendor-specific domains (acedata.cloud) are associated with the skill's author.- [SAFE]: The provided Python script scripts/bluesky.py handles complex tasks like image resizing and rich-text facet computation internally. This is a safer alternative to building complex shell commands with curl or jq, as it prevents command injection vulnerabilities related to shell quoting.- [SAFE]: No obfuscation, persistence mechanisms, or malicious prompt injection patterns were detected. The script includes logic to validate image integrity using the Pillow library before uploading, which reduces the risk of uploading non-image data. The skill's behavior is consistent with its stated purpose of social media automation.

bluesky