Glasses to Social

This skill is generally coherent with its stated purpose, but pause before installing and consider privacy and access controls: - The SKILL.md tells you to set the Google Drive folder to 'Anyone with link can view'. That makes your photos publicly accessible to anyone who gets the link. Prefer a private folder and use authenticated Drive access (OAuth or a service account) instead of a public share. - The scripts require gdown and jq but the skill doesn't provide installation steps — ensure you install these from trusted package sources and run the scripts in a controlled directory. - The instructions for image analysis and posting are vague: decide which vision service/model will run and where drafts are stored/transmitted. If you use a third-party vision API, review its privacy policy and avoid sending sensitive photos. - Posting automation requires social media credentials. Use a dedicated account or app token with limited scope and rotate/revoke keys if needed. Ensure the agent asks for explicit approval before posting (autoPost=false by default is safer). - Consider removing/examining EXIF/metadata from photos before uploads and obtain consent from people who appear in images. - If you want tighter security, modify the pipeline to use Google Drive API with OAuth/service account rather than gdown + public shares, and add explicit logging and review steps. Confidence in this assessment is medium. If you want a higher-confidence verdict, provide answers or changes to: how Google Drive access will be authenticated (public link vs OAuth/service-account), which vision service will be used, and the exact posting mechanism for social platforms.