TRMNL

Send concise text, notifications, or updates with optional Markdown and images to a TRMNL e-ink terminal display via webhook.

Security Scan

The skill's instructions do what they claim (POST messages to a TRMNL webhook) but it hardcodes a third‑party webhook endpoint with no way for the installing user to configure their own device or provide authentication, which is inconsistent with the stated purpose and could be used to leak data.

Purpose & Capability

The SKILL.md states the skill is for sending content to a user's TRMNL e-ink device, which is coherent with using a webhook. However the webhook URL is hardcoded in the instructions (https://trmnl.com/api/custom_plugins/0d9e7125-789d-46a6-9a51-070ac95364d8) and there is no mechanism (no required env var, no config path, no install-time prompt) for the installing user to supply their own webhook or authenticate. That means messages from any user installing this skill would be posted to the single embedded endpoint rather than to a per-user device — a mismatch between claimed purpose and actual configuration.

Instruction Scope

The runtime instructions tell the agent to POST arbitrary user-provided content to the fixed external URL via curl. There is no guidance to confirm device ownership, no sanitization or filtering, and no restriction against sending secrets. This grants the skill the ability to transmit any text the user (or agent) supplies to a third-party endpoint.

Install Mechanism

No install spec and no code files: the skill is instruction-only and does not write files or download code. This is the lowest install risk.

Credentials

The skill declares no environment variables or credentials, which would normally be expected if the skill needed to target a user's personal webhook or authenticate to a device. The absence of configurable credentials combined with a hardcoded webhook is disproportionate and suspicious.

Persistence & Privilege

The skill is not always-enabled and requests no persistent system privileges. It does not modify other skills' configs or system settings based on the provided metadata.

What to consider before installing

This skill will send whatever text the agent posts directly to the embedded trmnl.com webhook URL. Before installing or using it: (1) do not send secrets or private data through it, (2) verify who controls the hardcoded webhook URL — it may not be your device, (3) prefer a skill that lets you configure your own webhook URL or use authenticated access, and (4) test with harmless content first. If you intend to use your own TRMNL device, ask the skill author to replace the hardcoded endpoint with a configurable environment variable or setup flow that requires proof of device ownership.

TRMNL Display Skill

This skill sends content to a TRMNL e-ink display device using the webhook API.

Webhook Configuration

• Endpoint: https://trmnl.com/api/custom_plugins/0d9e7125-789d-46a6-9a51-070ac95364d8
• Method: POST
• Content-Type: application/json

How to Send a Message

Use curl to POST a JSON payload with merge_variables:

curl "https://trmnl.com/api/custom_plugins/0d9e7125-789d-46a6-9a51-070ac95364d8" \
  -H "Content-Type: application/json" \
  -d '{"merge_variables": {"title": "Your Title Here", "text": "Your message content here"}}' \
  -X POST

Available Merge Variables

The TRMNL device is configured with a template that supports these variables:

Variable	Description
title	The main heading displayed prominently
text	The body content below the title (supports Markdown)
image	Fully qualified URL to an image (displayed on the right side)

Markdown Support

The text field supports Markdown formatting for richer content:

• Bold: **text**
• Italic: *text*
• Lists: Use - item or 1. item
• Line breaks: Use \n in the JSON string
• Headers: ## Heading (use sparingly, title is already prominent)

Usage Examples

Simple notification:

{"merge_variables": {"title": "Reminder", "text": "Stand up and stretch!"}}

Status update with formatting:

{"merge_variables": {"title": "Build Status", "text": "**All tests passing**\n\nReady to deploy."}}

List format:

{"merge_variables": {"title": "Today's Tasks", "text": "- Review PR #42\n- Update docs\n- Team standup at 10am"}}

Weather-style info:

{"merge_variables": {"title": "San Francisco", "text": "**Sunny, 72°F**\n\nPerfect day for a walk"}}

With image:

{"merge_variables": {"title": "Album of the Day", "text": "**Kind of Blue**\nMiles Davis", "image": "https://example.com/album-cover.jpg"}}

## Instructions for Claude

When the user asks to send something to their TRMNL device:

1. Parse the user's request to extract a title and message
2. If only a message is provided, generate an appropriate short title
3. Keep titles concise (under 30 characters recommended)
4. Keep text brief - e-ink displays work best with short, readable content
5. Use Markdown formatting to enhance readability (bold for emphasis, lists for multiple items)
6. If relevant, include an image URL (must be a fully qualified public URL)
7. Send the webhook using the curl command above
8. Confirm to the user what was sent

If the user provides arguments like `/trmnl Meeting in 5 minutes`, interpret the first few words as a potential title and the rest as the message, or use your judgment to create an appropriate title/text split.

## Response Handling

A successful response looks like:
```json
{"message":null,"merge_variables":{"title":"...","text":"..."}}

If you see an error message in the response, inform the user of the issue.

Notes

• The device refreshes periodically, so content may not appear instantly
• E-ink displays are monochrome - no color support
• Keep content concise for best readability on the small screen
• Images must be fully qualified public URLs (e.g., https://example.com/image.png)
• Images are displayed on the right side in a two-column layout