Pipelinegate

This skill appears to implement the pipeline functionality it claims, but review these points before installing or exposing it: - Local server and environment probing: The server exposes a /v1/run API that can invoke a 'check-env' step which checks for the existence of supplied environment variable names (it returns which names are present or missing). While it doesn't return secret values, this lets callers probe the host environment. Run the server only on localhost or behind an access control mechanism and avoid exposing it to untrusted networks. - Dependency and install mismatch: SKILL.md requests pip packages (fastapi, uvicorn, pydantic, pyyaml, jsonschema). Registry metadata shows an unusual 'uv' id/kind; confirm your install system maps that to pip. The code also imports internal 'products.*' modules that must exist in your environment; otherwise the service will fail. Review/confirm availability of those product libraries. - Minor functional inconsistencies: The tools registry description claims conversion includes TOML but exec_convert only supports JSON and YAML; the SKILL.md doesn't state the 'check-env' probing explicitly. These are implementation mismatches (likely bugs) — confirm behavior before relying on the tool. - Run safely: If you test it, run in an isolated environment (container or VM) and bind uvicorn to 127.0.0.1. Inspect logs and network exposure. If you need to allow remote access, add authentication or restrict access to trusted hosts. If you want, I can point out the exact lines where environment probing and the JSON/YAML/TOML mismatch occur, or produce a minimal wrapper that starts the server bound to localhost only.