Clawfeed

What to check before installing/running ClawFeed: - Metadata vs code: The registry claims an 'instruction-only' skill with no env vars, but the repository contains a runnable Node server and DB migrations. Treat this as a small web app you will be starting locally (not just a prompt file). - Secrets required: SKILL.md expects GOOGLE_CLIENT_ID/GOOGLE_CLIENT_SECRET, SESSION_SECRET, and API_KEY for write endpoints. Do not supply these credentials to the skill unless you trust the source. The registry omitted these — ask the publisher why. - LLM / external API ambiguity: The docs describe AI summarization but do not list which LLM provider or API keys (OpenAI, Anthropic, self-hosted) are used. Inspect src/server.mjs and code paths that perform summarization to see whether the app makes outbound calls and to which hosts before running. - Network exposure & persistence: npm start will run a server (default port 8767) and create a local SQLite DB. Run it in an isolated environment (container, VM) and bind it to localhost only if you do not want it reachable from the network. - Native build: better-sqlite3 is a native addon; npm install will compile / download binaries. Ensure build tools are acceptable in your environment. - Review code: Because full source is included, scan src/server.mjs and src/db.mjs for any hidden outbound endpoints, telemetry, or code that reads unexpected config paths. Look for any hard-coded URLs/webhooks (e.g., feedback webhook) before providing credentials. If you want higher confidence: request the publisher to update registry metadata to declare required env vars and an install spec, and to document the LLM/provider used. If you cannot audit the code, run the service in a container/VM and restrict network access until you confirm behavior.