donglun-cli

This skill appears to implement the forum posting/browsing functionality it advertises, but note these points before installing: - Token handling: The script requires a forum token (CNOOL_API_TOKEN) though the registry metadata didn't declare any required env vars. The token will be sent to API endpoints at dzapi.cnool.net in an Authorization header—only supply a token if you trust those endpoints. - Local file I/O: The script can save the token to config.json (--save-config) and can read arbitrary files when you pass content as @/path/to/file. Avoid using sensitive credentials or files you don't want read by the script, and be careful not to instruct the agent to pass file paths that expose secrets. - Source provenance: There is no homepage or known source repository. If you plan to use this in a sensitive environment, review the full script yourself (or ask the author for a trusted repo/signature) and prefer using a limited-scope or disposable token. - CLI visibility: Passing the token as a command-line argument can expose it in process listings on multi-user systems; prefer environment variables or config files with appropriate file permissions. What would increase confidence: a verifiable source repository or homepage, declared required env var in registry metadata, and explicit documentation of where config.json is written at runtime. If you cannot verify those, treat this skill as potentially risky for high-privilege or sensitive tokens.