The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill utilizes the x-client package from the Mops registry (mops.one). While an automated scanner flagged this URL as suspicious, mops.one is the standard, official package registry for the Motoko programming language and the Internet Computer ecosystem. The dependency x-client is maintained by the skill author, caffeinelabs.
[CREDENTIALS_SAFE]: The skill implements a per-user OAuth 2.0 PKCE flow. It includes explicit instructions and architectural patterns to ensure that access tokens and refresh tokens are stored securely within the canister and never exposed to the frontend or logged to the console. It correctly identifies that Client IDs are public identifiers, while tokens are secrets.
[COMMAND_EXECUTION]: The skill requires setting is_replicated = ?false for all HTTP outcalls to X (Twitter). This is a critical security and functional requirement on the Internet Computer to prevent the bearer token from being sent multiple times (once by every node in the subnet) and to avoid consensus failures on non-deterministic API responses.
[DATA_EXFILTRATION]: No unauthorized data exfiltration patterns were detected. The skill only facilitates communication with official X API endpoints (api.x.com) and the Motoko package registry. It provides clear warnings against hand-rolling HTTP calls that could lead to accidental credential exposure.

extension-posting-to-x