blueskylisted

Everything runs through the shipped CLI [`scripts/bluesky.py`](scripts/bluesky.py) — self-contained (`requests` + `Pillow`, both preinstalled in the sandbox). One call creates the session, auto-computes clickable **facets** (links, #hashtags, @mentions with correct UTF-8 byte offsets), and for image posts downloads the file, **resizes/recompresses it to Bluesky's ~1 MB blob limit**, `uploadBlob`s it and builds the `app.bsky.embed.images` embed — so there's no fragile `curl + jq + heredoc` to hand-assemble (the old inline recipe kept breaking on shell quoting, especially once an image + facets were involved). Three connector credentials are injected: `$BLUESKY_HANDLE` (e.g. `name.bsky.social`), `$BLUESKY_APP_PASSWORD` (an App Password from Bluesky **Settings → Privacy and Security → App Passwords**, NOT the login password) and `$BLUESKY_SERVICE` (PDS base URL, default `https://bsky.social`). The CLI reads them from the env — never echo them. ```sh # $SKILL_DIR can point at another skill loaded this turn — anchor on our own # script (re-run this at the top of every fresh-shell Bash block below). BSKY="$SKILL_DIR/scripts/bluesky.py"; [ -f "$BSKY" ] || BSKY=$(find /tmp -maxdepth 8 -path '*/skills/*/scripts/bluesky.py' 2>/dev/null | head -1) [ -f "$BSKY" ] || { echo "bluesky script not found (SKILL_DIR=$SKILL_DIR)" >&2; exit 1; } python3 "$BSKY" whoami # verify the session → {did, handle, service} ``` If `whoami` fails with `session_failed` / `AuthenticationRequired`,