✓
Purpose & Capability
Name/description promise multi-agent orchestration and autonomous workflows; requesting a ONEPERSON_API_KEY to talk to an external 1person.pro service is consistent and expected.
✓
Instruction Scope
SKILL.md contains only descriptive text and basic setup instructions (obtain API key and set ONEPERSON_API_KEY). It does not instruct the agent to read unrelated files, access other env vars, or exfiltrate data.
✓
Install Mechanism
No install spec and no code files — lowest-risk instruction-only skill with nothing written to disk by the skill itself.
✓
Credentials
Only a single service-specific credential (ONEPERSON_API_KEY) is required; this is proportionate to a skill that proxies requests to an external SaaS API.
✓
Persistence & Privilege
Skill does not request always:true or other elevated persistence; it is user-invocable and allows normal autonomous invocation but does not request system-wide changes.
Scan Findings in Context
[no_regex_findings] expected: Scanner found no code files to analyze (instruction-only SKILL.md). This is expected for a wrapper that simply delegates to an external API.
Assessment
This skill appears to be a thin integration for the 1person.pro service and only asks you to provide its API key. Before installing: verify the legitimacy of https://1person.pro and its docs, ensure the API key you provide has the minimal permissions you want to grant, review the service's privacy/TOS to understand what data will be stored or processed, and avoid reusing a high-privilege or broadly-scoped key. If you need stronger assurance, review network calls or ask for a more detailed integration spec from the provider.
