Skill Rating Comparator

This skill appears to implement a legitimate feature (compare skills on ClawHub/GitHub), but there are several red flags you should consider before installing or running it: - Inspect SKILL.md and README for hidden/unicode control characters. These can be used to manipulate prompts; if present, remove them or reject the package. - Review the source locally. The implementation currently uses mock data and TODOs instead of real API calls; if you expect production behavior, ask the author for a complete implementation or inspect code paths that fetch external data. - Check package.json and declared dependencies. SKILL.md lists node-fetch and cheerio but they are not in package.json; installing/building could fail or the author may expect the runtime to provide them. Add only trusted dependencies and run npm audit before installing. - Because the skill interacts with external services (GitHub/ClawHub), consider running it in a sandboxed environment (container) first to observe network behavior and avoid exposing local files. - If you want full functionality, confirm whether the skill will require API credentials (GitHub token, ClawHub token) and only provide least-privilege tokens with appropriate scope. The current package does not request credentials, but a future/complete implementation likely will. If you are not comfortable reviewing code or handling hidden characters, prefer a skill from a known author or an official marketplace listing with clear provenance.