swarma - growth loops

This skill appears to implement the advertised growth-experiment loop, but there are a few mismatches and practical risks to address before installing: - Confirm required credentials: SKILL.md requires OPENROUTER_API_KEY for LLM usage but the registry shows no required env vars. Only provide this key if you trust the upstream code and understand its LLM usage and limits. - Confirm install/source: SKILL.md refers to Python/pip and a GitHub repo but the registry has no install spec. Ask the publisher for an explicit install plan (exact pip package name or vetted release URL) and inspect the repository before running pip install. - Sandbox runtime installs and servers: Because the skill can start servers (REST/MCP) and a scheduled engine, consider running it in a sandboxed environment (container or VM) and restricting network exposure until you audit the code. - Review code/repo: Before giving any API keys or allowing autonomous runs, review the repository (https://github.com/glitch-rabin/swarma) or ask the author for a trustworthy release. Look for unexpected network calls, telemetry, or credential exfiltration code. - Least privilege: Provide only the minimum API key scope needed for OpenRouter (or prefer ephemeral/test keys) and avoid supplying high-privilege secrets (cloud credentials, SSH keys, database passwords). If the publisher can (a) add an explicit install spec, (b) reconcile registry metadata with SKILL.md (declare OPENROUTER_API_KEY requirement), and (c) provide a vetted release link or package name, that would materially reduce the uncertainty.