put.io (kaput CLI)

This skill is a thin, coherent wrapper around the kaput CLI and appears low-risk, but take these precautions before installing/using it: - Verify the kaput-cli package/source before running 'cargo install' (crates.io packages are arbitrary code that will be compiled/run on your machine). Prefer installing from a trusted repository or review its source. The SKILL.md calls kaput 'unofficial'. - Use the kaput device-code login flow as instructed; do not paste credentials into chat. Treat the CLI's token file as sensitive and keep it private (the CLI stores it locally). - Be aware that any command that adds transfers will cause put.io to fetch content specified by URLs/magnets you supply; only add URLs you trust. The skill can run these commands autonomously if the agent is allowed to invoke skills, so restrict agent autonomy if you don't want it creating transfers without your review. - If you want stronger isolation, run kaput in a controlled environment (local user account or container) rather than on a shared machine. Overall, the skill's behavior and requirements match its stated purpose; the remaining risk is the normal risk of installing and running an external CLI (verify the CLI itself).