Nexus Safe

This skill appears to do what it says (local monitoring + policy-controlled restarts), but there are packaging and documentation gaps you should address before enabling it to perform restarts: - Verify required binaries and env vars: _meta.json and monitor.py require docker, pm2, and NEXUS_SAFE_* environment variables. The registry metadata you were shown contradicted this — confirm which is authoritative and set ALLOWED lists explicitly. - Keep restarts disabled by default: leave NEXUS_SAFE_ALLOW_RESTARTS unset/false until you’ve tested behavior in dry-run mode and reviewed audit.log entries in ~/.nexus-safe/audit.log. - Test with dry-run: use the --dry-run option to confirm which commands the skill would execute and that the allowlist protects only intended services. - Inspect and control inputs: ensure any values passed as service names come from trusted sources (the code uses subprocess.run with argument lists, which mitigates shell injection, but validating service names is still good practice). - Install deps manually from a trusted environment: pip install psutil from an environment you control; there is no installer bundled with the skill. If you want higher assurance, ask the publisher to correct the registry metadata to list required binaries/env vars in the public manifest and to document explicit setup steps for the allowlists and enabling restarts.