Bluetooth

This skill is mostly coherent for managing Bluetooth devices, but review and tighten before installing. - Contradictory security guidance: the docs both forbid storing pairing keys in plain text and instruct documenting PIN/passkeys in profiles. Decide on a single secure policy (prefer not storing secrets; if you must, encrypt them). - Local sensitive data: profiles/history will contain MAC addresses, device names, timestamps, and possibly pairing info. Protect ~/bluetooth with restrictive file permissions (chmod 700) or avoid storing persistent secrets. - Packet capture requires root: btmon/packet capture needs elevated privileges; only run captures in a controlled environment and delete captures when done. - External syncs: use-cases reference pushing data to Strava/Garmin/Health but no credential handling is provided. Do not enter third-party credentials unless you understand where and how they will be stored/transmitted; prefer manual, explicit auth flows. - Logging/privacy: 'log everything' can create a privacy risk (location tracking via MACs). If you install, configure what is logged and avoid exporting logs off-device. - Agent autonomy: the skill is user-invocable and can be followed by the agent at runtime; if you allow autonomous agent actions, consider restricting its permissions or asking for confirmations for pairing/first connections. What would change this assessment: if the skill included executable code or an install script that performed network calls, uploaded profiles, or requested credentials automatically, it would be higher risk. If the author supplied clear encrypted-storage guidance for secrets and an explicit, secure mechanism for external syncs (OAuth flows, scoped tokens), that would reduce concerns.