Beads Task Tracker

This skill appears to do what it says (a git-backed task tracker) but you should be cautious before installing. Key things to consider: - Provenance: there is no homepage/source URL or maintainer info in the metadata. Before installing, find and inspect the brew formula and the npm package (@beads/bd) to verify their source and contents. - Inspect code: review the npm tarball or the formula's upstream URL to see what bd does, especially any code that auto-syncs, runs daemons, or executes arbitrary commands. - Test in a sandbox: install and run bd in an isolated or disposable git repository (not a sensitive project) to see what files (.beads/, hooks) it creates and what network calls it makes. - Git credentials: bd sync will use whatever git auth is configured (SSH keys, tokens). Avoid installing/using bd in repositories where pushing/pulling could leak sensitive data or trigger CI/jobs you don't intend. - Git hooks: bd hooks install will write to .git/hooks and may run on commits; inspect these hooks before enabling them in important repos. - Installation scope: prefer local or per-project install rather than global, and avoid running it on systems with elevated access until you trust the package. If you want to proceed, first locate the package sources (npm/brew formula), audit the scripts and hooks, and run bd in a throwaway repo to observe behavior. If you cannot find or inspect the upstream source, treat the package as higher risk.