Glance

What to consider before installing: - Source verification: the README points to https://github.com/acfranzen/glance and an install script at openglance.dev. Confirm you trust those domains and review the install script before running it — never pipe an unknown remote script to bash. - Environment mismatch: the registry only declares GLANCE_URL, but the docs expect many other env vars (AUTH_TOKEN, OPENCLAW_TOKEN, GLANCE_DATA, etc.) and will ask the agent to manage API keys. Expect the skill to read/write local files and store credentials locally. - Local access & auth bypass: the docs state localhost requests with an Origin header bypass bearer auth and show direct sqlite access commands. That means an agent following these docs may access local data and the Glance DB; verify whether that behavior is acceptable. - Persistence: the project recommends installing as a system service (launchd/systemd). If installed, it will run continuously and accept webhook callbacks — consider isolating it (container or VM) if you have sensitive secrets on the host. - Recommended mitigations: review the GitHub repo and the install script before running; prefer container/Docker installation rather than running on host; do not give the agent carte blanche to run install commands; confirm how credentials are encrypted and where the encryption key is stored; restrict network access to the service where feasible. If you want to proceed, ask the skill maintainer for a signed release or the exact install script contents, and request that required environment variables be declared explicitly in the registry metadata so you can evaluate required secrets up front.