Bluesky

Complete Bluesky CLI: post, reply, like, repost, follow, block, mute, search, threads, images. Everything you need to engage on Bluesky from the terminal.

Security Scan

The skill's requested files, instructions, and environment access match its stated purpose as a Bluesky CLI; no disproportionate credentials, unusual installs, or unexplained endpoints were found.

Purpose & Capability

Name/description (Bluesky CLI) align with the code and SKILL.md. The code depends on the atproto Python package (declared in requirements.txt) and uses only python3 as a required binary. Required files and config paths (~/.config/bsky/config.json) are consistent with a CLI that stores a session token for API access.

Instruction Scope

SKILL.md limits actions to login, posting, timeline, search, and other Bluesky operations and instructs users to create an app password and run local bsky commands. It does direct the user to supply an app password (used to obtain a session token). Minor inconsistency: README advises 'Save this password somewhere safe' while SKILL.md and the code emphasize the password is used once and not stored (the code migrates to and stores a session string). This is a documentation inconsistency but not evidence of exfiltration.

Install Mechanism

There is no remote download or opaque installer in the metadata; dependencies are a standard PyPI package (atproto in requirements.txt). The skill is instruction/code-based and does not reference external, untrusted URLs for installation. The README mentions auto-creating a venv and installing atproto on first run which is a common pattern.

Credentials

The skill requests no environment variables in the registry metadata. At runtime the CLI can read BSKY_PASSWORD (a reasonable convenience option) and writes a session token to ~/.config/bsky/config.json with restrictive permissions (600). No unrelated credentials or broad access are requested.

Persistence & Privilege

always is false and the skill does not request system-wide privileges. It writes its own config under ~/.config/bsky/ which is expected for a CLI. There is no evidence it alters other skills or global agent settings.

Assessment

This appears coherent for a Bluesky CLI, but review these before installing: 1) The tool asks you to create an 'App Password' on bsky.app and to provide it to bsky login — that's expected. Never paste that password into unknown remote sites; the script uses it to obtain a session token and (per code) stores only the session token locally. 2) The CLI stores a session string at ~/.config/bsky/config.json with 0600 perms — inspect that file if you want to verify what is stored. 3) The dependency atproto is pulled from PyPI (requirements.txt); if you want higher assurance, inspect the atproto package source/version you will install. 4) Minor docs inconsistency: README suggests 'save this password' while the SKILL.md/code say the password isn't stored — treat the app password as sensitive and prefer relying on the stored session token. 5) Tests reference a scripts/venv/python path; ensure the venv creation behavior (auto-creation on first run) meets your security policy if you prefer not to have the skill create virtual environments automatically. If you are comfortable with a local CLI that communicates with Bluesky's API and with installing the atproto dependency, this skill is proportionate to its purpose.

Bluesky CLI

Full-featured CLI for Bluesky/AT Protocol.

Agent Instructions

First: Check if logged in

bsky whoami

• If shows handle → ready to use commands below
• If "Not logged in" → guide user through Setup section

Common tasks:

• "Post to Bluesky" → bsky post "text"
• "Check my timeline" → bsky timeline
• "Like this post" → bsky like <url>
• "Follow someone" → bsky follow @handle

Setup

If user isn't logged in (bsky whoami shows "Not logged in"), guide them through setup:

Getting an App Password

Tell the user:

Go to bsky.app → click your avatar → Settings → Privacy and Security → App Passwords → Add App Password. Name it "OpenClaw" and copy the password (like xxxx-xxxx-xxxx-xxxx). You'll only see it once!

Logging In

Once they have the app password, run:

bsky login --handle THEIR_HANDLE.bsky.social --password THEIR_APP_PASSWORD

Example:

bsky login --handle alice.bsky.social --password abcd-1234-efgh-5678

Security: Password is used once to get a session token, then immediately discarded. Never stored on disk. Session auto-refreshes.

Quick Reference

Action	Command
View timeline	bsky timeline or bsky tl
Post	bsky post "text"
Post with image	bsky post "text" --image photo.jpg --alt "description"
Reply	bsky reply <url> "text"
Quote-post	bsky quote <url> "text"
View thread	bsky thread <url>
Create thread	bsky create-thread "Post 1" "Post 2" "Post 3" or bsky ct
Like	bsky like <url>
Repost	bsky repost <url>
Follow	bsky follow @handle
Block	bsky block @handle
Mute	bsky mute @handle
Search	bsky search "query"
Notifications	bsky notifications or bsky n
Delete post	bsky delete <url>

Commands

Timeline

bsky timeline              # 10 posts
bsky timeline -n 20        # 20 posts
bsky timeline --json       # JSON output

Posting

bsky post "Hello world!"                           # Basic post
bsky post "Check this!" --image pic.jpg --alt "A photo"  # With image
bsky post "Test" --dry-run                         # Preview only

Reply & Quote

bsky reply <post-url> "Your reply"
bsky quote <post-url> "Your take on this"

Thread View

bsky thread <post-url>           # View conversation
bsky thread <url> --depth 10     # More replies
bsky thread <url> --json         # JSON output

Create Thread

bsky create-thread "First post" "Second post" "Third post"   # Create a thread
bsky ct "Post 1" "Post 2" "Post 3"                           # Short alias
bsky create-thread "Hello!" "More thoughts" --dry-run         # Preview only
bsky create-thread "Look!" "Nice" --image pic.jpg --alt "A photo"  # Image on first post

Engagement

bsky like <post-url>             # ❤️ Like
bsky unlike <post-url>           # Remove like
bsky repost <post-url>           # 🔁 Repost (aliases: boost, rt)
bsky unrepost <post-url>         # Remove repost

Social Graph

bsky follow @someone             # Follow user
bsky unfollow @someone           # Unfollow user
bsky profile @someone            # View profile
bsky profile --json              # JSON output

Moderation

bsky block @someone              # 🚫 Block user
bsky unblock @someone            # Unblock
bsky mute @someone               # 🔇 Mute user
bsky unmute @someone             # Unmute

Search & Notifications

bsky search "query"              # Search posts
bsky search "topic" -n 20        # More results
bsky notifications               # Recent notifications
bsky n -n 30                     # More notifications

Delete

bsky delete <post-url>           # Delete your post
bsky delete <post-id>            # By ID

JSON Output

Add --json to read commands for structured output:

bsky timeline --json
bsky search "topic" --json
bsky notifications --json
bsky profile @someone --json
bsky thread <url> --json

Error Handling

Error	Fix
"Session expired"	Run bsky login again
"Not logged in"	Run bsky login --handle ... --password ...
"Post is X chars (max 300)"	Shorten text
"Image too large"	Use image under 1MB

Notes

• All <url> parameters accept either https://bsky.app/... URLs or at:// URIs
• Handles auto-append .bsky.social if no domain specified
• Image posts require --alt for accessibility (Bluesky requirement)
• Session tokens auto-refresh; password never stored