Munger Decision

This package mostly looks like a legitimate decision-assistant implementation, but there are two things to check before installing or running it in an agent environment: 1) Mismatch: the registry says "instruction-only" / no install, but the bundle contains many source files and a package-lock.json and SKILL.md instructs to run npm install. Ask the publisher why the registry metadata presents it as instruction-only and confirm the intended installation/run steps. 2) Inspect dependencies and scripts: open package.json and package-lock.json and check for any postinstall/prepare scripts or unusual dependencies (personal Git URLs, tarball URLs, or packages with broad permissions). If you must run npm install, do it in an isolated sandbox/container and scan network activity. Prefer to run tests and lints locally in a sandbox first. Other practical checks: - Review package.json scripts for lifecycle hooks that execute arbitrary code. - Grep src/ for network calls (fetch, axios, http, net, child_process/exec), eval, or code that reads paths outside the skill directory (e.g., /root or system config paths). - Confirm the skill will not require any API keys or credentials for its core functionality. If you cannot audit the package, run it with restricted filesystem and network permissions (or in a disposable VM) rather than directly in an agent that has access to production data or other skills.