!
Purpose & Capability
The skill's purpose (emailing an INR value) is simple and coherent with the included script, but the metadata claims no required binaries or credentials while the script calls /root/go/bin/gog and specifies a fixed --account value (harpoutian@gmail.com). The missing declaration of that binary/credential is an inconsistency.
!
Instruction Scope
SKILL.md and the script only perform email sending, which is in-scope. However the script hard-codes recipient addresses (creatif.lrb@aphp.fr and harpoutian@gmail.com) and includes highly sensitive personal data (full name and date of birth). It also assumes a particular locale and environment (LC_TIME fr_FR.UTF-8) and a specific binary path, which broadens its implicit scope and risk.
!
Install Mechanism
There is no install spec (instruction-only), but the script depends on an external tool at /root/go/bin/gog. Expecting an unlisted binary at a root-owned path is risky and likely to cause failures or require elevated setup. The skill should declare/install (or at least require) the gog tool instead of assuming its presence.
!
Credentials
The package declares no required environment variables or credentials, yet the script uses a specific Gmail account (--account harpoutian@gmail.com) and therefore implicitly requires authentication/credentials for that account in the 'gog' tool. This mismatch is disproportionate and unexplained. Also, transmitting health data is sensitive and needs explicit consent/accountability.
✓
Persistence & Privilege
The skill is user-invocable and not flagged always:true; it does not claim persistent/system-wide privileges or modify other skills. However, the script's use of a root-path binary suggests it assumes a particular installation location and privileges.
What to consider before installing
Before installing or using this skill, consider these points:
- The script calls /root/go/bin/gog — the skill did not declare that binary. Confirm whether 'gog' is installed, where it is installed, and how it's authenticated; otherwise the skill will fail or require privileged setup.
- The script hard-codes sender account (harpoutian@gmail.com) and recipient addresses (creatif.lrb@aphp.fr and a Gmail test address). Verify you consent to sending sensitive health data (INR + name + date of birth) to those addresses and that the addresses are correct and authorized.
- The skill does not declare or request credentials, but it implicitly needs authentication for the Gmail account. Ask the publisher how credentials are supplied and stored by 'gog' — do not provide credentials without understanding storage and access controls.
- Prefer a version that allows configurable sender/recipient and omits or anonymizes DOB, or that documents installation steps (how to install/authenticate 'gog') and where credentials are kept.
- If you cannot verify the 'gog' tool and the account setup, test in an isolated environment and avoid using real personal health data or real accounts until you confirm behavior.
If you need help verifying the gog binary, or rewriting the script to avoid hard-coded sensitive data, provide the environment details and I can suggest safer alternatives.
