Remix Agent Publish

This skill looks like a focused publishing helper for remix.gg, but a few inconsistencies need attention before you install or use it: - API key missing from metadata: The documentation and code snippets expect a server-side Remix API key (Authorization: Bearer <api_key> / process.env.REMIX_API_KEY), but the skill metadata does not declare any required environment variables or primary credential. Treat this as a red flag — confirm that any agent using the skill will obtain and store the API key in a secure server-side secret manager (not client-side) and that the skill's manifest is updated to declare the credential. - Conflicting API claims: Some documents say agent REST is read-only for certain surfaces, while other docs and examples call POST endpoints (create game and upload code). Before running, fetch the OpenAPI spec at https://api.remix.gg/docs/json (as the skill itself recommends) and rely on that for exact routes and allowed operations. - Misleading 'source of truth' references: The SKILL references internal repository paths (apps/server-api/...) that are not available to an external agent. Do not assume the agent can access those paths; instead use the public OpenAPI docs at api.remix.gg. - External script inclusion: The skill recommends embedding the Farcade SDK via cdn.jsdelivr.net. This is expected for Remix single-file uploads, but be aware that including third-party CDN scripts has supply-chain risks; prefer pinned versions and verify the version matches Remix validation requirements. What to ask/verify before installing: - Request the skill owner add REMIX_API_KEY (or equivalent) to requires.env/primary credential in the registry manifest. - Confirm which POST endpoints are actually permitted by the agent API (use the OpenAPI JSON). If the skill performs writes, ensure your API key has least privilege and that you understand what actions the key allows. - Ensure the agent will store the API key in a secure, server-side secret store and will not log or expose it in client-side code. If these issues are resolved (manifest updated, docs made consistent, and you confirm the OpenAPI contract), the skill's behavior appears coherent with its purpose. If the owner cannot or will not reconcile these inconsistencies, treat it as untrusted.