The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses Bash to execute its own CLI (postbridge-cli) and a local script (./scripts/post-bridge.js). It also mentions an optional workflow using ffmpeg for video processing and cron for task scheduling. These are clearly documented, intended functionalities that require user consent.
[EXTERNAL_DOWNLOADS]: The skill downloads the postbridge-cli package via npx from the official npm registry. It also interacts with api.post-bridge.com and mcp.post-bridge.com. These are official service endpoints for the skill's author, post-bridge-hq.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data such as social media captions and analytics from various platforms. While this presents a surface for indirect injection, the skill includes explicit instructions for agents to ask for user confirmation before publishing content and provides guidelines for safe automation.
[SAFE]: Secret management follows industry best practices. The skill instructs users to store API keys in .env files or local configuration files. The bundled script (scripts/post-bridge.js) ensures that configuration directories and files are created with restricted permissions (0o700 for directories and 0o600 for files) to prevent unauthorized access on shared systems.

post-bridge