X To Kindle

This skill appears to implement its stated function, but there are two practical concerns you should consider before installing: 1) Secrets and metadata mismatch: SKILL.md and the script require SMTP_EMAIL, SMTP_PASSWORD (app password), and KINDLE_EMAIL, but the registry metadata lists no required env vars. Do not assume the skill is safe just because metadata omits credentials — the code will need them. 2) Arbitrary-file-sending risk: The included tool will send any local file path you pass to it to the configured Kindle email. That is necessary to send the generated HTML, but it also means a mis-invocation or malicious agent behavior could exfiltrate local files. To reduce risk: - Use a dedicated email account (Gmail) and an app-specific password with minimal access; avoid using your primary account. - Use a disposable or limited-permissions Kindle address if possible. - Only grant SMTP_PASSWORD to skills you trust, and prefer rotating the app password after testing. - Inspect and, if possible, modify the script so it only accepts files from a controlled directory (e.g., a sandboxed /tmp/<skill>/ folder) or validates filenames before sending. - Confirm how your agent platform prompts you (or not) before invoking the tool; require explicit user confirmation for any send operation. - Verify network calls (fxtwitter API) are acceptable for your privacy policy; consider using an API you trust or self-hosted fetch logic. If you cannot or will not follow these mitigations, avoid installing or provide only throwaway credentials for testing.