@acedatacloud/skills 2026.703.9 → 2026.703.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@acedatacloud/skills",
-  "version": "2026.703.9",
+  "version": "2026.703.11",
   "description": "Agent Skills for AceDataCloud AI services — music, image, video generation, LLM chat, web search. Compatible with Claude Code, GitHub Copilot, Gemini CLI, OpenAI Codex, and 30+ AI coding agents.",
   "keywords": [
     "agent-skills",

package/skills/bluesky/SKILL.md

@@ -0,0 +1,147 @@
+---
+name: bluesky
+description: Publish, delete and read your own posts on Bluesky via the AT Protocol (XRPC). Use when the user wants to post to their Bluesky account, cross-post an article as a short dev-focused post, delete a post, or list their own recent posts with engagement stats (reposts, likes, replies). Auth uses the user's handle plus an App Password.
+when_to_use: |
+  Trigger when the user wants to publish a post to their Bluesky account,
+  delete one, or review their own recent posts and engagement. Bluesky runs on
+  the AT Protocol: the connector stores the user's handle plus an App Password
+  (NOT the main account password) and a PDS service URL (default
+  https://bsky.social). Confirm the post text with the user before publishing.
+connections: [bluesky]
+allowed_tools: [Bash]
+license: Apache-2.0
+metadata:
+  author: acedatacloud
+  version: "1.0"
+---
+
+Call the **Bluesky AT Protocol** XRPC endpoints with `curl + jq`. Three
+connector credentials are injected: `$BLUESKY_HANDLE` (e.g. `name.bsky.social`),
+`$BLUESKY_APP_PASSWORD` (an App Password created in Bluesky **Settings →
+Privacy and Security → App Passwords**, NOT the account login password) and
+`$BLUESKY_SERVICE` (the PDS base URL, default `https://bsky.social`).
+
+Errors come back as JSON `{"error":"<name>","message":"<detail>"}` — show it
+verbatim. A `401 {"error":"AuthenticationRequired"}` on session creation means
+the handle or App Password is wrong/revoked → the user must re-connect the
+Bluesky connector (or generate a fresh App Password).
+
+## Step 1 — always create a session first
+
+Everything needs a short-lived `accessJwt` and your account `did`. Do this once
+per task and reuse the values:
+
+```bash
+SVC="${BLUESKY_SERVICE:-https://bsky.social}"
+SESSION=$(curl -sS -X POST "$SVC/xrpc/com.atproto.server.createSession" \
+  -H "Content-Type: application/json" \
+  -d "$(jq -n --arg id "$BLUESKY_HANDLE" --arg pw "$BLUESKY_APP_PASSWORD" \
+        '{identifier:$id, password:$pw}')")
+echo "$SESSION" | jq '{did, handle, active}'
+JWT=$(echo "$SESSION" | jq -r .accessJwt)
+DID=$(echo "$SESSION" | jq -r .did)
+```
+
+If `JWT` / `DID` are empty or `null`, print the raw `$SESSION` (it contains the
+error) and stop — do not continue to post.
+
+## Post to Bluesky
+
+**Confirm the text with the user before posting.** Text is limited to **300
+graphemes**; longer text → `400 {"error":"InvalidRequest"}`. `createdAt` must be
+an ISO-8601 UTC timestamp.
+
+```bash
+TEXT="Hello Bluesky 👋 shipping with the AT Protocol"
+NOW=$(date -u +%Y-%m-%dT%H:%M:%S.000Z)
+curl -sS -X POST "$SVC/xrpc/com.atproto.repo.createRecord" \
+  -H "Authorization: Bearer $JWT" \
+  -H "Content-Type: application/json" \
+  -d "$(jq -n --arg did "$DID" --arg text "$TEXT" --arg now "$NOW" \
+        '{repo:$did, collection:"app.bsky.feed.post",
+          record:{ "$type":"app.bsky.feed.post", text:$text, createdAt:$now, langs:["en"] }}')" \
+  | jq '{uri, cid}'
+```
+
+The returned `uri` looks like `at://did:plc:xxxx/app.bsky.feed.post/<rkey>`. The
+public web URL is `https://bsky.app/profile/$BLUESKY_HANDLE/post/<rkey>` where
+`<rkey>` is the last path segment of the `uri`.
+
+### Clickable links, mentions and hashtags (facets)
+
+Plain URLs/hashtags in `text` are shown but **not clickable** — Bluesky needs
+`facets` with UTF-8 **byte** offsets. Add a hashtag link like this (byteStart/
+byteEnd are byte indices into the UTF-8 text, not character indices):
+
+```bash
+# text = "New post about #ai" — "#ai" starts at byte 15, ends at byte 18
+curl -sS -X POST "$SVC/xrpc/com.atproto.repo.createRecord" \
+  -H "Authorization: Bearer $JWT" -H "Content-Type: application/json" \
+  -d "$(jq -n --arg did "$DID" --arg now "$NOW" '
+    {repo:$did, collection:"app.bsky.feed.post",
+     record:{ "$type":"app.bsky.feed.post", text:"New post about #ai", createdAt:$now,
+       facets:[ { index:{byteStart:15, byteEnd:18},
+                  features:[{ "$type":"app.bsky.richtext.facet#tag", tag:"ai" }] } ] }}')" \
+  | jq '{uri, cid}'
+```
+
+For a link, use feature `app.bsky.richtext.facet#link` with a `uri` field; for a
+mention, `app.bsky.richtext.facet#mention` with a `did`. Compute byte offsets
+with e.g. `printf '%s' "$prefix" | wc -c`.
+
+## List my recent posts + engagement
+
+```bash
+curl -sS "$SVC/xrpc/app.bsky.feed.getAuthorFeed?actor=$DID&limit=20&filter=posts_no_replies" \
+  -H "Authorization: Bearer $JWT" \
+  | jq '.feed[] | {uri: .post.uri,
+                   text: .post.record.text,
+                   reposts: .post.repostCount,
+                   likes: .post.likeCount,
+                   replies: .post.replyCount,
+                   at: .post.indexedAt}'
+```
+
+`limit` max 100. `filter` options: `posts_with_replies`, `posts_no_replies`,
+`posts_with_media`, `posts_and_author_threads`.
+
+## Delete a post
+
+`deleteRecord` needs the `rkey` (the last path segment of the post `uri`):
+
+```bash
+POST_URI="at://$DID/app.bsky.feed.post/3kabc123xyz"
+RKEY="${POST_URI##*/}"
+curl -sS -X POST "$SVC/xrpc/com.atproto.repo.deleteRecord" \
+  -H "Authorization: Bearer $JWT" -H "Content-Type: application/json" \
+  -d "$(jq -n --arg did "$DID" --arg rkey "$RKEY" \
+        '{repo:$did, collection:"app.bsky.feed.post", rkey:$rkey}')" \
+  | jq '{deleted: true, rkey: "'"$RKEY"'"}'
+```
+
+An empty `{}` response is success. `400 {"error":"InvalidRequest"}` usually
+means the record is already gone or the `rkey` is wrong.
+
+## Attaching images (optional)
+
+Upload each image via `POST $SVC/xrpc/com.atproto.repo.uploadBlob`
+(`Content-Type: image/jpeg`, raw bytes body, Bearer `$JWT`) → returns a `blob`
+object. Then set `record.embed` to
+`{ "$type":"app.bsky.embed.images", images:[{ alt:"<desc>", image:<blob> }] }`.
+Max 4 images per post; each blob ≲ 1 MB (resize/compress first).
+
+## Gotchas
+
+- **App Password, not account password:** creating a session with the real
+  login password may be rejected or trip 2FA. Always the App Password from
+  Settings → App Passwords.
+- **Byte offsets, not char offsets:** facet `byteStart`/`byteEnd` are UTF-8
+  byte indices — emoji and CJK take multiple bytes. Get them wrong and the
+  link highlights the wrong span.
+- **300 graphemes**, counted as user-perceived characters (emoji = 1).
+- **Rate limits:** the PDS rate-limits writes per account; space out bulk posts
+  or you'll get `429 {"error":"RateLimitExceeded"}`.
+- **Self-hosted PDS:** if the user runs their own PDS, `$BLUESKY_SERVICE` points
+  there; all XRPC calls target that host, not `bsky.social`.
+- The `accessJwt` is short-lived (~2h). For a single task it's fine; if it
+  expires mid-task, just re-run Step 1.

package/skills/mastodon/SKILL.md

@@ -0,0 +1,103 @@
+---
+name: mastodon
+description: Publish, delete and read your own posts (toots) on any Mastodon instance via the Mastodon REST API. Use when the user wants to post a toot to their Mastodon / fediverse account, cross-post an article as a short dev-focused post, delete a toot, or list their own recent posts with engagement stats (boosts, favourites, replies).
+when_to_use: |
+  Trigger when the user wants to publish a status/toot to their Mastodon
+  account, delete one, or review their own recent posts and engagement.
+  Mastodon is federated: the connector stores the instance base URL plus a
+  personal access token, so every call targets the user's own instance.
+  Confirm visibility (public/unlisted) before posting publicly.
+connections: [mastodon]
+allowed_tools: [Bash]
+license: Apache-2.0
+metadata:
+  author: acedatacloud
+  version: "1.0"
+---
+
+Call the **Mastodon REST API** with `curl + jq`. Two connector credentials are
+injected: `$MASTODON_BASE_URL` (the instance, e.g. `https://mastodon.social`)
+and `$MASTODON_ACCESS_TOKEN`. Every request sends the header
+`Authorization: Bearer $MASTODON_ACCESS_TOKEN`.
+
+Errors come back as JSON `{"error":"<message>"}` — show it verbatim. `401`
+(`"The access token is invalid"`) means the token is wrong/revoked → the user
+must re-connect the Mastodon connector. Posting needs the token to have the
+`write` (or `write:statuses`) scope.
+
+**Always confirm the token + account first** (also gives the account `id` you
+need to list your own toots):
+
+```bash
+curl -sS "$MASTODON_BASE_URL/api/v1/accounts/verify_credentials" \
+  -H "Authorization: Bearer $MASTODON_ACCESS_TOKEN" \
+  | jq '{id, username, acct, display_name, followers: .followers_count, statuses: .statuses_count}'
+```
+
+## Post a toot
+
+**Confirm with the user before posting publicly.** Default `visibility` to
+`unlisted` unless they say post publicly; use `public` only on request.
+
+```bash
+STATUS_TEXT="Hello fediverse 👋 #introductions"
+curl -sS -X POST "$MASTODON_BASE_URL/api/v1/statuses" \
+  -H "Authorization: Bearer $MASTODON_ACCESS_TOKEN" \
+  -H "Idempotency-Key: $(uuidgen)" \
+  --data-urlencode "status=$STATUS_TEXT" \
+  --data-urlencode "visibility=unlisted" \
+  --data-urlencode "language=en" \
+  | jq '{id, url, visibility, created_at}'
+```
+
+- `visibility` is one of `public`, `unlisted`, `private`, `direct`.
+- Optional params: `spoiler_text` (content warning), `in_reply_to_id` (reply),
+  `sensitive=true`, `language` (ISO 639-1).
+- `Idempotency-Key` (any unique string; `uuidgen` here) prevents duplicate
+  posts if the request is retried within ~1h. Use `--data-urlencode` so
+  hashtags, emoji and newlines in the text are encoded correctly.
+- Default post length is 500 chars (instance-configurable); longer text →
+  `422 {"error":"Validation failed: Text ..."}`.
+
+## List my recent toots + engagement
+
+Use the `id` from `verify_credentials`:
+
+```bash
+ACCT_ID="14715"   # from verify_credentials
+curl -sS "$MASTODON_BASE_URL/api/v1/accounts/$ACCT_ID/statuses?limit=20&exclude_replies=true&exclude_reblogs=true" \
+  -H "Authorization: Bearer $MASTODON_ACCESS_TOKEN" \
+  | jq '.[] | {id, url, boosts: .reblogs_count, favs: .favourites_count, replies: .replies_count, created_at}'
+```
+
+`limit` max 40. Other filters: `only_media`, `pinned`, `tagged=<hashtag>`.
+
+## Delete a toot
+
+```bash
+curl -sS -X DELETE "$MASTODON_BASE_URL/api/v1/statuses/STATUS_ID" \
+  -H "Authorization: Bearer $MASTODON_ACCESS_TOKEN" | jq '{id, deleted: true}'
+```
+
+Deleting returns the status with its source `text` so you can delete-and-redraft.
+`404 {"error":"Record not found"}` = not yours or already gone.
+
+## Attaching media (optional)
+
+Upload each image/video via `POST $MASTODON_BASE_URL/api/v2/media`
+(`multipart/form-data`, field `file`) to get a media id, then pass the ids as
+`media_ids[]` when posting the status. See the docs for the full media contract:
+https://docs.joinmastodon.org/methods/media/
+
+## Gotchas
+
+- **Federated:** the API only ever targets `$MASTODON_BASE_URL` (the user's own
+  instance). There is no global endpoint — a token from instance A won't work
+  on instance B.
+- **Scopes:** reading needs `read` (or `read:accounts`/`read:statuses`);
+  posting/deleting needs `write` (or `write:statuses`). A `403`
+  (`"This action is outside the authorized scopes"`) means the token lacks a scope.
+- **Rate limits:** Mastodon rate-limits per token; space out bulk posts or you'll
+  get `429`.
+- `verify_credentials` returns HTML in fields like `note`; the plaintext source
+  lives under the `source` object.