Duolingo Tracker

This skill is mostly coherent for its stated purpose, but a few issues warrant caution: - Metadata/manifest problems: the registry shows 'Required env vars: [object Object]' which looks like a serialization bug — ask the publisher or inspect the source to confirm the exact env requirements before proceeding. - Unnecessary requirement: the skill declares python3 as required but the instructions only show curl/bash usage. Ask why python3 is listed or prefer a version that omits it. - Sensitive token: full/private stats require your browser jwt_token (DUOLINGO_JWT). Treat this like a password: do not paste it into public chat, logs, or third-party services. Use the unauthenticated endpoints (public profile) if you don't want to share the token. - Source provenance: the skill has unknown source and no homepage. Prefer skills from known maintainers or that include source code you can inspect. - Operational notes: endpoints used are Duolingo domains (including a leaderboards domain) — verify those exact domains if you have concerns. If you ever suspect compromise, revoke sessions from your Duolingo account (logout everywhere) to invalidate the JWT. Before installing or enabling this skill, ask the publisher for the source code or a clear explanation why python3 is required and request corrected registry metadata. If you must provide DUOLINGO_JWT, consider creating a throwaway account or limit sharing to local, trusted environments only.