Preflight Check

This skill appears to do what it says (preflight checks) but there are important mismatches and privacy risks you should consider before installing or running it: - Metadata mismatch: The skill's metadata declares no required env vars, yet the instructions read many sensitive variables (service tokens, private keys, GOOGLE_APPLICATION_CREDENTIALS). Ask the author to declare all env vars and explain why each is needed. - Secret handling: The SKILL.md prints fragments of sensitive values and writes a JSON report to disk. Ensure reports never include full secrets, are stored in a secure location, and are not sent to external endpoints. Prefer presence checks (test -n, test -f) instead of echoing secret contents. - Permissions: claw.json requests filesystem and network access. If you allow this skill, restrict it to user-invoked runs (disable autonomous invocation) or run it in an isolated/local environment to avoid accidental exfiltration. - Operational controls: If you still want to use it, require the author to: 1) Update metadata to list the env vars/binaries it will access. 2) Remove or redact any printing of secret values (do not include private key fragments in reports). 3) Make network checks explicit and optional, and document any external endpoints contacted. 4) Provide a signed/known source or package release (currently source/homepage are unclear). If you cannot get those assurances, run this skill only in a controlled environment (throwaway project or ephemeral container) and inspect the generated report before sharing it.