Soul Sync

This skill is not outright malicious, but it contains behaviors that contradict the SKILL.md privacy promises — so proceed cautiously. Before installing or running it: 1) Inspect the importers you care about (local_system, gmail/calendar, github, apple, etc.) to confirm what paths they read and whether they reuse existing tokens. 2) If you want to test, run the scripts in a sandboxed environment or on a throwaway account/workspace that does not contain real tokens or sensitive files. 3) Verify whether the skill will prompt for OAuth browser consent every time you connect an account; if it silently uses token files found in your workspace or git credential store, that could access data without a fresh prompt. 4) If you plan to use it, consider removing or moving any existing credential files from the workspace/home (gmail_token.json, token.json, GITHUB_TOKEN, SPOTIFY creds) until you explicitly choose to authorize. 5) Ask the author to reconcile the SKILL.md claims (no access outside workspace, opt-in-only imports) with the code paths that read Downloads/Desktop/~/Library and write to /tmp, and request an explicit mode that refuses to touch any file outside a single designated workspace directory. If you cannot get satisfactory answers, treat this skill as higher risk and only run it in an isolated environment.