The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill stores the Twenty CRM API bearer token in plaintext within the ~/.ocli/profiles.ini configuration file. While the script attempts to secure the file using umask 077 and chmod 600 to restrict access to the current user, the secret remains unencrypted on the filesystem.
[CREDENTIALS_UNSAFE]: The non-interactive setup functionality allows the API token to be passed via the --token flag (node scripts/twenty.mjs setup --token <key>). This practice can expose the sensitive token in shell history, process monitors, and system logs.
[COMMAND_EXECUTION]: The skill relies on the execution of multiple CLI tools, including ocli, jq, and node (for inline date conversions via node -e). These commands are executed using execFileSync with argument arrays, which mitigates standard shell injection risks, but remains a significant capability surface.
[EXTERNAL_DOWNLOADS]: During the setup and refresh processes, the skill uses the Node.js fetch API to download OpenAPI specifications directly from the user-provided CRM instance URL. This is a legitimate functional requirement for generating the CLI interface but involves interacting with external network resources.

twenty-crm