Nomtiq

Things to check before installing or enabling Nomtiq: - Clarify env var requirements: SKILL.md expects AMAP_KEY, SERPER_API_KEY and MOLTBOOK_API_KEY but top‑level metadata listed none. Only provide keys you trust and intend to use. Use least‑privilege keys (e.g., restrict referer/IP and quotas). - Review the scripts (search_*.py, profile.py, moltbook.py) yourself (or in a sandbox) to confirm what data is read, written, and sent. Pay attention to what profile data is posted when you enable Moltbook sharing. - Treat Moltbook sharing as potentially exfiltrative: it will send restaurant records externally (claimed anonymous, limited to 2/day); only opt in if comfortable. - Remove or sanitize any unicode control characters in SKILL.md to eliminate prompt‑injection risk before letting an LLM execute skill prompts. - If you want extra safety, run the skill in an environment with network egress controls (or a proxy) so you can observe and limit outbound requests (especially to third‑party endpoints like google.serper.dev and www.moltbook.com). - If you lack the ability to audit Python code, prefer not to install the skill or only enable it with network access restricted and without enabling Moltbook posting. I have medium confidence in this assessment because the code and instructions mostly align with the declared purpose, but the metadata mismatch and prompt‑injection signal raise nontrivial concerns that should be resolved before trusting the skill with keys or private data.