Vestaboard

Read and write messages on a Vestaboard using the Vestaboard Cloud API (cloud.vestaboard.com) and optional legacy RW endpoint. Use when asked to display text on a Vestaboard, update a sign/board, show a short status message, render simple pixel-art using color/filled character codes, or retrieve the current board message.

Security Scan

The skill's code and instructions legitimately interact with Vestaboard's Cloud API, but the registry metadata omits the required environment credentials and primary-credential declaration — this mismatch should be fixed or justified before installing.

Purpose & Capability

The name/description, SKILL.md, ENV.md, and scripts/vb.js all align: this skill reads and writes a Vestaboard via cloud.vestaboard.com (or legacy RW endpoint) and supports text or numeric layouts. The included preview/layout files and character-code reference are appropriate for the stated purpose.

Instruction Scope

Runtime instructions are confined to formatting text, reading local layout files, and making HTTP GET/POST calls to the Vestaboard API base. The SKILL.md and scripts only reference the declared Vestaboard endpoints and local content files; there is no unrelated file-system or network activity, no obfuscated endpoints, and no broad data collection.

Install Mechanism

This is instruction-plus-code (no install spec). The package.json requires the 'undici' npm package and SKILL.md suggests running 'npm install' — a standard npm dependency install. There are no downloads from arbitrary URLs or archive extraction. Note: undici package requires Node >=20.18.1 per package-lock.json; ensure your environment meets that.

Credentials

The skill requires secrets at runtime (VESTABOARD_TOKEN preferred; VESTABOARD_RW_KEY legacy; optional VESTABOARD_API_BASE) as shown in SKILL.md and ENV.md, but the registry metadata lists no required environment variables or primary credential. That metadata omission is an inconsistency — the skill does need credentials to operate and these should be declared in the registry entry.

Persistence & Privilege

The skill does not request permanent presence (always: false), does not modify other skills or system-wide settings, and has no special config-path requirements. Allowing autonomous invocation is the platform default; the skill itself does not request elevated persistence.

What to consider before installing

This skill appears to be what it says (a Vestaboard client) and its code is readable. However: (1) the registry metadata incorrectly shows no required environment variables — in reality you must provide VESTABOARD_TOKEN (or legacy VESTABOARD_RW_KEY) and optionally VESTABOARD_API_BASE; verify and supply those securely (do not commit them). (2) Review scripts/vb.js and ENV.md yourself before running npm install. (3) Ensure your node runtime meets the undici requirement (Node >= 20.18.1). (4) If you enable autonomous invocation for an agent, be aware the agent could call the Vestaboard API whenever the skill is invoked; only grant the token to agents you trust. If the metadata omission is accidental, request the publisher update the registry entry to declare the required credentials before installing.

Security

• Require a token via environment variables (never inline keys in prompts, logs, or commits).
  • Preferred: VESTABOARD_TOKEN
  • Optional legacy fallback: VESTABOARD_RW_KEY

Constraints

• Flagship Vestaboard layout is 6 rows x 22 cols.
• Text input is formatted to 6x22 by default (uppercase + word wrap; truncates overflow).

Quick usage (local CLI)

# from repo root
npm install

# Preview formatting only
node scripts/vb.js preview "Hello from Quarterbridge Farm"

# Read current message (JSON)
node scripts/vb.js read

# Write text
node scripts/vb.js write "EGGS READY"

# Write a numeric layout (6x22 array of character codes)
node scripts/vb.js write-layout content/layouts/forest-depth.json

Sample content

• Numeric layouts live in content/layouts/*.json
• Human review previews live in content/previews/*.md