rednote-contacts

This skill appears to be what it claims (a wrapper to run the red-crawler CLI), but there are a few things to check before installing: - Metadata vs reality: The skill's metadata claims no required binaries and labels itself as instruction-only, yet it bundles a Python entrypoint and its runtime will call external CLIs (git, uv, and Playwright). Expect that you need git, the 'uv' command used by the project, and a working Playwright/Chromium runtime. - Remote code: install_or_bootstrap may git-clone a remote repository (default: github.com/Batxent/red-crawler). Only allow cloning and executing code from repositories you trust; review the repository contents before running. - Sensitive session state: Crawling authenticated pages uses a Playwright storage_state file (state.json) which contains cookies and session data — treat it as a secret. If you provide a storage_state file, the skill (and the crawler it runs) can act as that authenticated user. - Local filesystem access: The skill reads/writes the workspace, pyproject.toml, SQLite DB, and output artifacts. Run in an isolated directory or sandbox if you are concerned about accidental overwrites or data leakage. - Review runtime commands: The included tests and code show it will run 'git clone', 'uv sync', 'uv run playwright install chromium', and 'uv run red-crawler ...'. Ensure these commands are acceptable in your environment. If you plan to use this skill: (1) review the remote repo before bootstrapping, (2) run the first bootstrap in an isolated environment, (3) avoid supplying storage_state files from high-privilege accounts unless necessary, and (4) consider restricting autonomous runs or monitoring what the agent executes. If you want, provide the repo URL and I can highlight exact files/lines in that repo to inspect for risky behavior.