Smooth Browser

This skill appears to be an instruction-only wrapper for the Smooth web-automation service, but there are important inconsistencies and privacy risks to consider before installing or using it: - The SKILL.md explicitly requires a Smooth API key and suggests installing `smooth-py`, yet the registry metadata does not declare any credentials or an install step. Treat the API key requirement as real even though it's not listed. - By default sessions are proxied through Smooth's infrastructure (the doc references a built-in proxy). That means the content of pages you visit, form data, cookies, and any credentials you give to the agent could be routed through a third party. If you have sensitive accounts, do not reuse real credentials or sessions without confirming Smooth's privacy/security policy. - The skill encourages persistent profiles (saved cookies and sessions). Persisted session data can be reused by the agent later; avoid storing long-lived credentials in those profiles unless you fully trust the service and understand where the data is stored and who can access it. - The SKILL.md recommends installing a PyPI package (`pip install smooth-py`). Installing packages from third-party sources carries code-execution risk; verify the package source, publisher reputation, and checksums if possible. Recommended actions before use: - Confirm the legitimacy of https://app.smooth.sh and the `smooth-py` package (owner, docs, privacy/security policy). Prefer vendor-supplied install metadata in the registry. - Do not provide real account credentials during testing; use throwaway/test accounts to evaluate behavior. - If you must use for sensitive tasks, require an explicit declaration of the API key env var in the skill metadata and consider disabling the default proxy (--no-proxy) where possible and safe. - If you are uncomfortable with third-party routing of browsing data, do not enable or supply credentials to this skill. Because of the metadata/instruction mismatch and the potential for sensitive data to be routed to a third party, I rate this skill as suspicious. If you want, I can draft specific questions to ask the skill author/owner to resolve the inconsistencies (e.g., provenance of smooth-py, where session data is stored, explicit env var names, and proxy architecture).