Blogwatcher.Bak

Monitor blogs and RSS/Atom feeds for updates using the blogwatcher CLI.

Security Scan

This is an instruction-only skill that consistently asks for a blogwatcher CLI binary (installed via a public Go module) and does not request unrelated credentials or system access.

Purpose & Capability

The name/description, required binary (blogwatcher), and install instruction (go install github.com/Hyaxia/blogwatcher/cmd/blogwatcher@latest) are coherent for a feed-watching CLI. Note: small metadata inconsistencies exist (registry slug 'blogwatcher-bak' / ownerId differs from _meta.json which lists slug 'blogwatcher' and a different ownerId) — this looks like bookkeeping/mismatch rather than a capability mismatch.

Instruction Scope

SKILL.md only instructs installing/using the blogwatcher CLI and lists commands (add, scan, list, read, remove). It does not direct the agent to read unrelated files, environment variables, or exfiltrate data to unexpected endpoints. Running the CLI will of course fetch external RSS/Atom URLs provided by the user (expected behavior).

Install Mechanism

Install uses 'go install' of a public GitHub module which will compile and install code fetched from that repository. This is expected for Go-based CLIs but carries the normal git/module risk: code executed on install is whatever is in the repo at the referenced version (@latest here, which may change). No downloads from obscure hosts or IP addresses were used.

Credentials

The skill declares no required environment variables, credentials, or config paths. Nothing requested appears disproportionate to an RSS/feed watcher.

Persistence & Privilege

The skill is not forced-always, does not claim elevated persistence, and contains no instructions to modify other skills or global agent settings.

Assessment

This skill appears to be what it says: a thin wrapper around a Go-based blog/RSS CLI. Before installing, review the GitHub repository source (https://github.com/Hyaxia/blogwatcher) to ensure you trust the code, and consider pinning to a specific released version rather than @latest. Be aware that the CLI will make network requests to any feeds you add (so don't add private feeds or sensitive URLs unless you trust the tool), and that installing the Go module compiles and runs code fetched from the repo. Also note the minor metadata mismatch between the published registry metadata and the _meta.json (different slug/ownerId) — likely benign but worth double-checking.

blogwatcher

Track blog and RSS/Atom feed updates with the blogwatcher CLI.

Install

• Go: go install github.com/Hyaxia/blogwatcher/cmd/blogwatcher@latest

Quick start

• blogwatcher --help

Common commands

• Add a blog: blogwatcher add "My Blog" https://example.com
• List blogs: blogwatcher blogs
• Scan for updates: blogwatcher scan
• List articles: blogwatcher articles
• Mark an article read: blogwatcher read 1
• Mark all articles read: blogwatcher read-all
• Remove a blog: blogwatcher remove "My Blog"

Example output

$ blogwatcher blogs
Tracked blogs (1):

  xkcd
    URL: https://xkcd.com

$ blogwatcher scan
Scanning 1 blog(s)...

  xkcd
    Source: RSS | Found: 4 | New: 4

Found 4 new article(s) total!

Notes

• Use blogwatcher <command> --help to discover flags and options.