chill.institute

PassAudited by ClawScan on May 1, 2026.

Overview

This instruction-only skill is coherent and disclosed, but it uses your logged-in put.io session to start transfers, so you should confirm the selected item before sending.

Before installing, be aware that this skill is meant to use a logged-in chill.institute/put.io browser session and can start transfers in your put.io account. Have it show you the exact item before sending, complete OAuth yourself, avoid sharing passwords, and use it only for content you have rights to access.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

A mistaken selection could add unwanted content to the user's put.io transfers.

Why it was flagged

The instructions allow the agent to choose a search result and initiate a transfer in the user's put.io account.

Skill content
Pick the best result ... Click send to put.io.
Recommendation

Ask the agent to show the chosen result, size, quality, and source before clicking send.

What this means

The agent can perform the described transfer workflow using the active browser session.

Why it was flagged

The skill relies on a logged-in OAuth browser session to act on the user's put.io account.

Skill content
User must be logged in to chill.institute (put.io OAuth in the browser).
Recommendation

Use an isolated browser profile, complete OAuth yourself, do not share passwords in chat, and log out or clear the session when finished.

What this means

Running this command executes code outside this instruction-only skill's artifact set.

Why it was flagged

The workflow includes an optional local shell command from a separate putio skill to verify transfers.

Skill content
bash skills/putio/scripts/list_transfers.sh
Recommendation

Only run the verification command if the separate putio skill is installed from a trusted source and you are comfortable with its script.