Devlog

This skill does what it says — it scans local AI coding session stores and generates an agent-narrated devlog, and can optionally publish to services like Hashnode — but review a few things before using it: - The package metadata claims 'no required binaries', but the included scripts require a POSIX shell and python3. Make sure python3/bash are available or expect the scripts to fail. - The skill will scan application data directories (e.g., ~/.local/share/opencode, ~/.gemini/tmp, ~/.config, ~/Library). These scans are necessary to discover session transcripts, but they can reveal other local data. If you have sensitive files in these locations, inspect the scripts first or run the skill in a controlled environment. - Publishing uses service credentials (e.g., HASHNODE_PAT). The SKILL.md instructs the agent to ask you for credentials if they're not set — do NOT paste secrets into the chat if you don't want them captured. Prefer exporting credentials into your shell environment (export HASHNODE_PAT=...) or using a secure secret injection mechanism rather than sending tokens in a message. - Review the publish.sh and any network-calling code before invoking publishing: confirm which endpoints are used and whether data (including any cover image URLs) will be uploaded to third-party servers. - The read-session scripts attempt to strip raw tool outputs, but transcripts themselves can contain secrets (API keys, tokens, file contents). Inspect a sample session output the skill proposes to include before publishing or uploading anywhere. If you want to proceed: review the referenced platform scripts and publish script locally, ensure you run this in a trustable environment, and never paste long-lived secrets into an untrusted chat. If the skill author can update metadata to declare required binaries and list the publishing env vars up front (and remove the prompt-to-paste guidance), that would substantially reduce the current concerns.