Shaper

This skill is largely coherent with its stated purpose (acting inside a Shaper workspace), but there are some red flags you should consider before installing: - Credential handling mismatch: The SKILL.md instructs using SHAPER_API_KEY and SHAPER_WORKSPACE_SLUG (examples show exporting them), but the skill metadata declares no required env vars. Ask the publisher to explicitly declare required env vars in metadata so you can audit what secrets the skill will use. - Unauthenticated agent registration: The included references/tools.md documents an agent_register endpoint that requires no auth and returns an api_key and claim_url. That lets an agent create a workspace and obtain credentials autonomously — confirm whether the skill will call this endpoint automatically. If it does, an agent could create and use credentials without you providing them, which may be unexpected. - Least privilege: Only provide a workspace API key when needed, and prefer creating an ephemeral/test workspace for first use rather than giving access to production data. Do not put API keys into shared shell init files or public logs. - Ask the publisher to clarify: 1) whether the skill ever calls agent_register, 2) whether it stores or transmits the API key elsewhere, and 3) update metadata to list the env vars it actually uses. If the publisher cannot or will not clarify, treat the skill as higher risk and test in an isolated workspace. If you proceed, restrict the API key to a workspace with minimal sensitive data and monitor actions the agent takes (scopes created/completed, hill updates).