✓
Purpose & Capability
The skill declares it will fetch Bloomberg headlines and requires a binary named 'bbgwire' to do so. Requiring a CLI client that returns JSON for this purpose is coherent.
✓
Instruction Scope
SKILL.md only instructs the agent to run a single command ('bbgwire') and format its JSON output for the user. It does not request unrelated files, environment variables, or transmit data to unexpected endpoints in the instructions.
ℹ
Install Mechanism
Install spec uses the Go module github.com/8treenet/bbgwire@latest to produce the 'bbgwire' binary. Fetching and compiling a third‑party Go module from GitHub is a standard workflow but executes arbitrary code at install time — a moderate supply‑chain risk. No homepage or publisher details are provided in the skill metadata to help assess provenance.
✓
Credentials
The skill declares no environment variables, credentials, or config paths. This is proportionate for a read-only headline fetcher; nothing in SKILL.md attempts to access other credentials or system files.
✓
Persistence & Privilege
always is false, the skill does not request persistent system‑wide privileges, and there are no instructions to modify other skills or global agent settings.
Assessment
This skill appears to do what it says (run a CLI that returns Bloomberg headlines), but installing it compiles a third‑party Go package from github.com/8treenet/bbgwire. Before installing: (1) inspect the GitHub repo source (8treenet/bbgwire) for unexpected behavior (network calls, data exfiltration, shelling out), (2) verify the repo's reputation, recent commits, and license, (3) run the build/install in a sandboxed environment or container if possible, (4) confirm you are comfortable with a binary that will fetch content from the network and whether that could violate Bloomberg's terms, and (5) if you need stronger assurance, ask the publisher for a signed release or prefer an official Bloomberg client. If you cannot review the code or sandbox the binary, treat the install as potentially risky.
