!
Purpose & Capability
The stated purpose (background autonomous thinking that reads a user's notes and writes syntheses) reasonably requires reading/writing user knowledge directories. However, the SKILL explicitly treats the agent as having "host complete control permissions" and mandates Agentic Action Proposals that may clone repos, write scripts, and append to evolve queues — yet the skill declares no required config paths, no permissions, and no environment variables. That mismatch (claims of host-level actions without declared required privileges) is disproportionate.
!
Instruction Scope
The SKILL.md and referenced docs explicitly instruct the agent to read memory/knowledge directories, write outputs into specified output dirs, append one-line summaries into memory/evolve/candidates.md, and propose concrete code/engineering actions (e.g., clone a GitHub repo, write a demo to /tmp). Those are concrete file I/O and host-action behaviors beyond a purely informational skill. The instructions also treat such actions as mandatory ('必须执行'), granting broad discretion to perform engineering steps — not limited or gated by declared configuration or user approval.
✓
Install Mechanism
This is instruction-only with no install spec and no code files to execute. That reduces supply-chain risk because nothing is downloaded or installed, but it does not mitigate the risk coming from the instructions' expectations to access and modify the host filesystem.
!
Credentials
The skill declares no required environment variables or config paths, yet repeatedly references specific user directories (memory/, Knowledge Base dirs, memory/evolve/candidates.md, PROPOSED_CHANGES.md, HEARTBEAT.md) and expects the ability to append and create files. Requesting no credentials while expecting unrestricted host file access is disproportionate and under-declared.
ℹ
Persistence & Privilege
always is false and autonomous invocation is allowed (platform default). The skill's execution flow mandates producing 'Agentic Action Proposals' and appending to an evolution queue; combined with its rhetoric about 'host complete control', this increases blast radius if the agent is allowed to act autonomously. Not flagged purely for autonomy, but the mandatory-action language combined with file-write expectations is risky without explicit permission controls.
What to consider before installing
This skill tells the agent to read and write your notes, produce daily 'synthesis' files, and generate concrete engineering actions (clone repos, write demo scripts, append to an 'evolve' queue) — yet it declares no filesystem paths, permissions, or approval gates. Before installing, consider: 1) Do you want an autonomous background skill that can modify files and suggest/perform host-level engineering actions? 2) If yes, restrict its scope: configure the asset paths to dedicated sandbox directories (not your entire knowledge base), make them read-only where appropriate, and require manual approval for any action that would execute code or modify system repos. 3) Prefer to run it in a confined environment (container or VM) first to observe behavior. 4) Ask the publisher to explicitly declare required config paths and an approval flow (e.g., proposal-only unless you authorize execution), or to provide a mode that only writes outputs to a safe, user-designated folder and never auto-appends to evolution queues. Additional information that would raise confidence: an explicit permission model, declared config paths limited to user-chosen sandbox directories, and a mode that requires user confirmation before any host-level action (clone/run/write outside a sandbox).