jy-position-diagnosis

What to consider before installing and using this skill: - Metadata vs runtime mismatch: The SKILL.md requires a JY_API_KEY (MCP service token) but the skill metadata did not declare any required credential — assume you will need to obtain and provide a gildata API key before use. Ask the publisher to add JY_API_KEY to the skill's declared requirements so it's explicit. - Verify mcporter before installing: The skill requires installing mcporter globally (npm install -g mcporter). Confirm the npm package owner, downloads, and repository (who publishes mcporter) and ensure it is the legitimate CLI you expect. Global npm installs can execute scripts and modify your system PATH. - Token handling: mcporter config add will embed the token in a stored URL/config file. Understand where mcporter stores configs and who can access them on your system. Do not reuse high-privilege or long-lived credentials; prefer a scoped key if gildata supports it. - Privacy of application data: To obtain JY_API_KEY the SKILL.md suggests emailing datamap@gildata.com with personal/company details. That is normal for enterprise API provisioning, but be mindful of what personal data you include and how the received key is used/stored. - Least privilege & testing: If possible, test with a low-privilege or sandbox key first. Consider installing mcporter in a contained environment (container or dedicated VM) if you are uncertain about installing global npm packages on a production machine. - Ask the publisher for provenance: There is no homepage or known source listed. If you plan to use this in production, request the skill's publisher identity, the mcporter package repository link, and a signed or reviewed manifest so you can validate trustworthiness. Given the above inconsistencies (missing declared credential and global npm install requirement), exercise caution. The skill appears to do what it claims, but the metadata underspecification and install mechanism justify extra verification before installation.