The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses uv run to execute a local Python script scripts/telegraph.py. This script handles the interaction with the Telegraph API and is executed within the agent's environment.
[CREDENTIALS_UNSAFE]: The skill manages Telegraph access tokens. Instead of passing tokens as command-line arguments (which could be leaked in process lists), it implements a secure mechanism to read tokens from environment variables or dedicated configuration files (~/.config/telegraph/access-token). When creating a new account, the script uses os.open with 0o600 permissions to ensure the token file is only readable by the owner.
[DATA_EXFILTRATION]: Network activity is restricted to the official Telegraph API endpoint (https://api.telegra.ph). The script includes a redaction function (_redact_secret) to prevent access tokens from accidentally being included in error messages or logs returned to the user.
[INDIRECT_PROMPT_INJECTION]: The skill processes user content to create pages. It mitigates injection risks by implementing a strict whitelist of allowed HTML tags (ALLOWED_TAGS) and attributes (ALLOWED_ATTRIBUTES), and it validates the entire node structure before submission. It also enforces a 64 KB limit on content size.
[REMOTE_CODE_EXECUTION]: All network requests are performed using the Python standard library's urllib.request. The skill does not download or execute external scripts or untrusted packages.

create-telegraph-pages