Bettafish Opinion Analysis

What to consider before installing: - Source and provenance: The repository/skill appears derived from an open-source project (README mentions GitHub), but registry metadata lists 'unknown' source/homepage. Prefer installing only from a trusted origin (official GitHub repo or verified publisher). - Missing install/dependency declarations: The skill contains many scripts and subskills but no install spec. You will likely need to install runtime dependencies manually (Python packages like reportlab, node/npm packages like docx, and system binaries such as ffmpeg). Confirm required packages and test in a controlled environment before running. - External network activity: The skill intentionally uses WebSearch/WebFetch/Browser/Curl to gather live web data — this is central to its purpose. Generated HTML includes external CDNs/Google Fonts/ECharts/D3.js; opening those reports will make outbound requests. If report content is sensitive, consider hosting libraries locally or disabling remote fonts to avoid telemetry/leakage. - Privacy and compliance: The skill aggregates public web content; ensure you are allowed to collect and process data from target platforms and that no private credentials or protected data are passed into the skill. The skill's docs claim 'no database' and 'no simulated data' — confirm that the actual runtime environment doesn't cache or persist sensitive inputs longer than intended. - Sandbox testing: Run the skill first in a sandboxed environment (non-production account, isolated VM) to observe: (1) what binaries it calls, (2) what external hosts it contacts, (3) any files written to disk. Verify behavior matches expectations before use with real or sensitive targets. - Verification steps: Ask the publisher for an explicit dependency/install manifest (requirements.txt, package.json, or an install script), confirm ffmpeg and Python/node package requirements, and request a statement of data handling/telemetry if you need stricter privacy guarantees. Given the above inconsistencies (undeclared dependencies and external resource loading), proceed cautiously. The skill appears functionally coherent with its description, but the missing install/dependency declarations and the use of external CDNs justify a 'suspicious' classification until those gaps are resolved.