Dupe

This skill behaves as described (it sends a product or image URL to api.dupe.com and returns matches), but there are a few things to consider before installing: - Privacy: any URL or image you give the skill will be transmitted to api.dupe.com. Don't provide links or images that contain private tokens, session IDs, or personally identifying content you don't want shared. - Provenance: the skill metadata shows no homepage and the registry owner is not human-readable; verify that api.dupe.com is the legitimate service you want to use. If you expect an official dupe.com integration, ask the publisher for a verifiable homepage or documentation. - Authentication & rate limits: the SKILL.md shows unauthenticated POST examples. Confirm whether the real API requires an API key or enforces rate limits — otherwise requests may fail or expose unintended data. - Safe testing: try the skill with non-sensitive, public product URLs first. If you need to send private images or internal URLs, avoid doing so until you confirm the service's privacy policy and access controls. If the publisher can provide a verifiable homepage, official documentation, or an explicit statement about how submitted data is stored/used, the assessment could be upgraded to benign.