Title Replier

• Risk level: Low
• Analyzed: Mar 30, 2026, 4:13 AM
• Findings: 0
• Version: 1.0.0

Overview

The skill's code and instructions are internally consistent with a simple local 'title replier' feature: it randomly picks non-repeating titles and stores usage in a local history file; it does not request credentials or network access.

This skill appears to do exactly what it says: pick a random non-repeating title and store recent history in a local file. Before installing, note: 1) SKILL.md mentions features not present (titles.js file, import-titles command, and automatic config.yaml loading) — these are documentation mismatches, not evidence of malicious behavior. 2) The skill writes history.json in the skill folder; ensure that directory is appropriate and does not contain sensitive files you don't want overwritten. 3) There are no network calls or credential requests, which reduces risk. If you want to be extra cautious, open index.js yourself (it's short), run it in a sandbox or review it line-by-line, and confirm the agent integration will call the exported reply() function only when you expect.