Universal Skills Manager

This skill appears to implement a legitimate universal skills manager, but there are several red flags you should consider before installing or giving credentials: - Inconsistencies: The registry metadata does not declare the SKILLSMP_API_KEY or required binaries, yet SKILL.md and config.json do. Ask the publisher to reconcile metadata and frontmatter so you know exactly what will be requested. - Review code before running: The package includes installer and downloader scripts that will fetch and write arbitrary files into many ~/.tool/ and project directories. Inspect scripts/install_skill.py and scripts/scan_skill.py yourself or run them in a sandboxed VM/container first. - Never pipe unknown remote scripts to sh: The SKILL.md recommends curl | sh as a convenience — avoid this. If you must run an installer from the project, fetch it, inspect it locally, then run it. - Limit credentials: Only provide SKILLSMP_API_KEY or GitHub tokens if you trust the publisher and understand scope; consider creating scoped or temporary tokens with minimal privileges. - Test safely: If you want to try the skill, do so on a disposable account or isolated environment (container or VM) and verify exactly which paths it modifies. If the publisher can (1) update registry metadata to declare required env vars and binaries, (2) remove or document the curl|sh shortcut, and (3) publish a verifiable homepage/release with checksums, the risk profile would be clearer and easier to evaluate.