MintGarden

This skill appears to do what it says: a MintGarden API client/CLI that talks to https://api.mintgarden.io. Before installing, consider: - The SKILL.md mentions an optional MINTGARDEN_API_URL env var, but the shipped index.js constructs MintGardenAPI() without reading process.env; if you need to point the skill at a different base URL you would need to modify the code or the constructor call. - The CLI lowercases incoming commands (index.js lowercases the entire input). That could alter case-sensitive IDs or metadata in some edge cases (verify behavior with your IDs). - Telegram integration is referenced in docs but not implemented in the code — expected to be provided by the agent/platform wiring. - The package requires npm install (and will install axios and its normal transitive deps). Review the package-lock.json and run npm audit if you want to check for dependency vulnerabilities. - The skill makes outbound network calls to api.mintgarden.io; if you need to restrict network access, run it in an environment that enforces outbound controls. If these points are acceptable, the code shows no signs of credential exfiltration or contacting unexpected endpoints. If you want stronger assurance, run the skill in a sandbox, inspect network traffic during use, or patch the code to honor a MINTGARDEN_API_URL environment variable if you require a custom endpoint.