ℹ
Purpose & Capability
The code implements PDF parsing, local JSON storage under /tmp, and builds Feishu cards — all coherent with a 'Contract Tracker'. However SKILL.md advertises 'fully offline', yet the billing module makes external HTTP calls to skillpay.me for per-call charging. Billing/network calls are not obviously part of an 'offline' claim and should be considered inconsistent with that statement.
ℹ
Instruction Scope
Runtime instructions and CLI/API usage stay within contract parsing, storage, and reminder generation. They do call the billing endpoint on actions (upload/check/export) and output Feishu card JSON when requested, but there is no code that automatically posts to Feishu — only card construction. Instructions do not reference reading unrelated files or secrets, but SKILL.md requires SKILL_BILLING_API_KEY for PRO tier which will cause network billing behavior when set.
✓
Install Mechanism
No install spec is provided (instruction-only in registry), which is lower risk. The package includes Python scripts and a requirements.txt (PyMuPDF, requests) — nothing downloaded from an untrusted URL or using an opaque installer. Running the included code will install/require packages via normal Python tooling (pip), so review before pip-installing.
!
Credentials
SKILL.md declares SKILL_BILLING_API_KEY and SKILL_BILLING_SKILL_ID; those are used by billing.py to call skillpay.me. The registry metadata at the top, however, lists 'Required env vars: none' — that mismatch is concerning. Requesting a billing API key is proportionate to a paid tier, but you should not set the API key unless you trust skillpay.me: when set the skill will perform network billing calls.
✓
Persistence & Privilege
The skill does not request always: true and does not modify other skills or system-wide settings. Storage is local to /tmp/contract-tracker (ephemeral) rather than the home directory; note /tmp may be accessible to other local users on some systems.
Scan Findings in Context
[OUTBOUND_NETWORK_REQUEST_skillpay] expected: billing.py issues POST requests to https://skillpay.me/api/v1/billing/charge to perform per-call charges. This is expected for a pay-per-call billing model but contradicts the 'fully offline' marketing claim.
[ENV_VAR_SKILL_BILLING_API_KEY] expected: The SKILL.md and billing.py use SKILL_BILLING_API_KEY and SKILL_BILLING_SKILL_ID to control billing behavior. This is expected for billing, but the registry metadata claims no required env vars — an inconsistency to verify.
[LOCAL_STORAGE_TMP_WRITE] expected: storage.py writes contract data to /tmp/contract-tracker/contracts.json as documented. This matches the README but note that /tmp may be world-readable on some systems (privacy consideration).
What to consider before installing
Things to consider before installing or providing credentials:
- Source verification: The skill has no homepage and an unknown source. Prefer skills with a verifiable owner or project homepage.
- Offline claim vs billing: SKILL.md says 'fully offline' for parsing, but the skill will contact https://skillpay.me to charge per call if SKILL_BILLING_API_KEY is set. If you need truly offline operation, do NOT set SKILL_BILLING_API_KEY (the code treats an empty key as dev mode and skips charging).
- Billing trust: The skill relies on a third-party billing endpoint (skillpay.me). Only set SKILL_BILLING_API_KEY if you trust that service and are prepared for per-call charges.
- Credentials & secrets: The only credential used is the billing API key; the skill does not attempt to read other system tokens. Still, avoid exposing sensitive organization-wide keys — use a dedicated low-privilege key if you test it.
- Data locality & privacy: Contracts are stored under /tmp/contract-tracker. On multi-user systems /tmp may be accessible by other local users; if that is a concern, modify STORAGE_DIR to a secure path before use.
- Feishu behavior: The code only formats Feishu cards; it does not automatically post messages. If you expect automatic push, verify how to integrate a Feishu bot securely (no code currently sends the card).
- Registry metadata mismatch: The registry claims no required env vars but SKILL.md requires billing env vars. Ask the author to correct the manifest or explain the discrepancy.
Recommended next steps: verify the maintainer/source, run the code in a sandboxed environment, and review/modify billing/env handling if you want strictly offline operation.
