Farcaster Skill

What to check before installing: - The code implements exactly what it claims (Farcaster via Neynar) but the registry metadata is incomplete: you must supply NEYNAR_API_KEY and NEYNAR_SIGNER_UUID and have curl, jq, and python3 available. Treat that omission as a red flag: prefer skills that declare their requirements explicitly. - Inspect the scripts yourself (they are plain bash). Pay special attention to the SKILL.md examples that show eval'ing jq on a JSON file you supply; only source credentials from files you trust, because eval-style commands can execute arbitrary content if misused. - The media-upload example posts files to a third-party host (litterbox.catbox.moe). If you will upload private images, review the privacy/security policy of that service or host media on a place you control. - The SKILL.md recommends a polling loop for mentions; continuous polling increases network traffic and risk of credential exposure in logs—if you enable monitoring, consider rate limits and where logs go. - Because the skill source and homepage are unknown, prefer installing from a trusted origin. If you plan to use it, require the owner to update registry metadata to list required env vars and binaries, and consider running the included smoke tests in an isolated environment first. If you want, I can produce a short checklist of commands to manually audit the scripts (what to grep for) or a set of recommended metadata fixes to ask the publisher to make.