Meta Workflow Discoverer

This skill's README promises automatic observation, cross-user learning, scheduling, and ML-powered discovery, but the included code implements a simple local recorder and heuristic pattern detection that runs only when you call its APIs and stores data in ~/.workflow_discoverer/{user_id}.json. Before installing or enabling it: - Expectation mismatch: don't assume it will monitor your activity in the background or share data across users — the files show no network or background-monitoring code in the visible portion. If those features are required, ask the author for the full implementation or for explicit network endpoints and privacy guarantees. - Local storage: it will create and write a JSON file in your home directory containing recorded task history; this may include sensitive task names, contexts, or parameters. Review that file and consider running the skill in a sandbox or with non-sensitive test data first. - Dependency note: SKILL.md suggests installing numpy/pandas/scikit-learn but the visible code doesn't use them. Avoid installing unnecessary packages unless you confirm they are actually required (or inspect the remainder of the code). - Audit recommendation: inspect the rest of workflow_discoverer.py (it was truncated) for any network calls, remote endpoints, or code that imports ML libraries or spawns processes. If you see any outbound HTTP requests, credential usage, or obfuscated code paths, do not enable autonomous invocation and run it in an isolated environment. What would change this assessment: if the remainder of the code contains justified ML usage (and the SKILL.md's install line matches imports), or if there are explicit, declared, and reasonable mechanisms for cross-user learning (with explicit endpoints and credential requirements), that would make the skill more coherent. Conversely, if hidden network calls or credential harvesters appear in the truncated portion, the risk would be higher.