bluesky

The bluesky skill presents a coherent and proportionate footprint for its stated purpose: read-only by default with explicit CLI-enabled posting actions, using a local shim and Bluesky app password for authentication. The primary security considerations concern local credential management (lettabot.yaml) and ensuring the shipped shim is trusted and verifiable. There are no evident malicious data flows or external exfiltration paths. Overall, the risk profile is low to moderate (benign with cautions around credential handling and supply-chain sanity of the local shim).