Comind

This skill appears to be a legitimate CoMind AI-member integration: it will read workspace files (tasks/TODO.md, CLAUDE.md, .comind-index), may read file contents for templates and heartbeats, and will make authenticated calls to your CoMind instance using COMIND_API_TOKEN. Before enabling: 1) Confirm you intend the agent to access local workspace directories and those specific files; 2) Provide a least-privilege COMIND_API_TOKEN (limit what the token can do and restrict it to the expected API surface); 3) Consider removing or asking the publisher to justify always: true — prefer user-invocable or scoped activation unless this must run on every agent session; 4) Run the skill in an environment where workspace files do not contain unrelated secrets; 5) Monitor CoMind audit logs and rotate the token periodically; 6) If you don’t run a CoMind instance or don’t want agents to access local workspaces, do not enable this skill. I have medium confidence: the components are coherent, but the persistent always-on privilege combined with bearer-token access warrants caution. Additional red flags that would increase severity: evidence of outbound exfiltration endpoints, unexpected required env vars, or install steps that fetch and execute arbitrary remote code.