testSkillX

Simple test skill that calls a GET endpoint to fetch a daily post. No authentication required.

Security Scan

The skill's behavior (a hard-coded request to an ephemeral ngrok URL) matches its description but the use of an unknown/external ngrok endpoint is disproportionate and could be used to collect or probe data, so proceed with caution.

Purpose & Capability

The name/description say it will fetch a daily post and the SKILL.md only requires performing a GET to a single endpoint — this is coherent with the stated purpose.

Instruction Scope

The runtime instructions require making a direct GET to a hard-coded ngrok-free.app URL (https://b024a53917d6.ngrok-free.app/agent/dailyPost). While the skill claims no auth or extra data is sent, the endpoint is an arbitrary external tunnel. That endpoint can respond with arbitrary content and could be used as a callback/exfiltration sink or to fingerprint the agent. The instructions do not explicitly limit headers or context sent, and they will return whatever the endpoint responds with, increasing risk.

Install Mechanism

This is an instruction-only skill with no install spec and no code files; nothing is written to disk or pulled from external archives.

Credentials

The skill requests no environment variables, credentials, or config paths — there are no disproportionate secret or credential requests.

Persistence & Privilege

The skill is not forced-always and has no special install privileges. However the SKILL.md header sets invoke: auto (and the registry settings allow model invocation), so the agent may autonomously call the external endpoint when triggers match — combined with the unknown endpoint this increases the blast radius compared to a purely manual skill.

What to consider before installing

This skill does exactly what it claims (performs a GET and returns the response) but it calls a hard-coded ngrok URL you don't control. Consider the following before installing: 1) Only use it if you trust the endpoint owner — ngrok endpoints are ephemeral and often run from personal machines. 2) Test with non-sensitive inputs first (don't allow the agent to include private conversation or secrets). 3) If you need stronger assurance, ask the author to host the endpoint on a stable, reputable domain or provide source code so you can inspect what headers/context are sent. 4) If you prefer minimal risk, disable autonomous invocation or block outbound network access for the skill.

DailyPost Test

This skill lets you trigger a GET request to fetch a daily post from the test endpoint.

🚀 How to use it

Just say one of these (or similar):

• "Show me the daily post"
• "Get today's post"
• "Fetch daily post"
• "Run dailypost"

The assistant will immediately make a GET request to: https://b024a53917d6.ngrok-free.app/agent/dailyPost

---

🛠️ What happens

1. Recognition: I recognize your request via the defined triggers.
2. Execution: I perform the following HTTP call:

   curl [https://b024a53917d6.ngrok-free.app/agent/dailyPost](https://b024a53917d6.ngrok-free.app/agent/dailyPost)
   

3. Response: I return whatever the endpoint sends back (text, JSON, etc.) directly to the chat.

---

🔒 Safety Notes

• No Authentication: No headers or private keys are sent with this request.
• Public Access: This is a standard public GET request.
• Error Handling: If the endpoint fails, returns a 404/500, or times out, I will notify you of the error.