Url Shorten

Shorten URLs via tinyurl or bitly API

Security Scan

The skill is mostly coherent for URL shortening, but its runtime instructions reference an environment variable (BITLY_TOKEN) that is not declared in the registry metadata — this mismatch and the implied sending of user URLs to external shortening services are the main concerns.

Purpose & Capability

Name/description (shorten via tinyurl/bitly) aligns with the declared requirement for curl and the SKILL.md instructions. No unrelated binaries, installs, or capabilities are requested.

Instruction Scope

SKILL.md explicitly instructs the agent to use BITLY_TOKEN if set, falling back to tinyurl otherwise. The instructions do not direct the agent to read other system files, but they do rely on an environment variable that is not declared in the skill metadata, which is an inconsistency and a potential surprise at runtime.

Install Mechanism

Instruction-only skill with no install steps and no code written to disk. Lowest-risk install posture.

Credentials

Requesting or using a BITLY_TOKEN would be proportional to the stated purpose, but the registry metadata lists no required env vars while SKILL.md references BITLY_TOKEN. The missing declaration reduces transparency about secret usage. Also, providing a token means the skill (when invoked) will send data to an external service, which has privacy implications.

Persistence & Privilege

Skill does not request always:true, does not modify agent/system config, and is user-invocable only. No elevated persistence or privileges are requested.

What to consider before installing

This skill appears to do what it claims (shorten URLs) and has no install actions, but note two issues: (1) SKILL.md expects an environment variable named BITLY_TOKEN though the registry metadata does not declare it — the skill will read that env var if present, so only set it if you trust the skill and understand the token's permissions; (2) shortened URLs (and the original URLs you provide) will be transmitted to external services (tinyurl or bitly), so avoid shortening URLs that contain sensitive tokens, private paths, or personal data. If you need assurance, ask the author to update the registry to declare BITLY_TOKEN as an optional credential and to document which endpoints are used, or test with non-sensitive example URLs first.

Shorten URLs via tinyurl or bitly API. Requires BITLY_TOKEN env var for bitly; falls back to tinyurl if not set.

Commands

# Shorten a URL (uses tinyurl by default, bitly if BITLY_TOKEN is set)
url-shorten "https://example.com/very/long/path/to/resource"

Install

No installation needed. curl is always present on the system. Optionally set BITLY_TOKEN environment variable to use the bitly API instead of tinyurl.