SKILL.md
Sent Messaging
Operate direct message workflows with messages.send, messages.get, and messages.activities.list.
Establish connection and scope
- Let the MCP client perform OAuth 2.1/PKCE authorization. Never request, accept, print, or store tokens, API keys, authorization headers, client IDs, or secrets.
- Surface the organization and Sender Profile selected by the active connection before a mutation. If the client context does not expose both, use
sent-account-readinessto inspect the authorized scope before continuing. - Use an explicit, validated acting profile when an organization grant supports it.
- Minimize sensitive output. Mask phone numbers where practical and do not repeat message bodies after the operator has reviewed them.
If MCP is unsupported or authorization fails, keep the skill usable for payload planning. Explain that execution requires a compatible client or reauthorization; never ask the user to paste a credential.
An organization grant may select an owned Sender Profile with the tool schema's optional profileId; omit it to act as the authenticated account. Validate ownership with sender_profiles.list or sender_profiles.get, and use the same selector for preflight reads, mutations, and follow-up reads. Profile grants cannot use this selector. Reauthorize for a different organization or a profile outside the grant. Never invent scope fields or request credentials.