Deyo
v1.0.3Use this skill when the user wants to install, run, or troubleshoot the published `deyo` transcription CLI, including one-time API key login, output file sel...
⭐ 0· 11·0 current·0 all-time
byCasa Taloyum@casatwy
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description match the instructions: the skill is explicitly about installing, configuring, running, and troubleshooting the published `deyo` CLI. Required resources are minimal (none declared) and the SKILL.md only references the published package @casatwy/deyo and the service URL posted in the instructions, which is proportionate to the stated purpose.
Instruction Scope
Instructions tell the agent to prefer an installed `deyo`, to run `npm install -g @casatwy/deyo` if missing, and to save a user-provided API key locally via `deyo auth login --api-key '...'`. This stays within the CLI's domain and does not ask to read unrelated files or secrets. Note: the skill instructs storing an API key locally (expected for a CLI) and directs users to the external site https://deyo.miaobi.fun/me/api-keys to create keys — users should verify they trust that upstream service before storing keys.
Install Mechanism
No install spec is embedded in the skill bundle (instruction-only). The only installation guidance is to run `npm install -g @casatwy/deyo`, which is a normal, expected action for a third-party CLI. No downloads from arbitrary URLs or extract steps are present in the skill itself.
Credentials
The skill declares no required environment variables, secrets, or config paths. The only credential-related action is to ask the user for an API key and run the CLI's own `deyo auth login` to store it locally — this is proportionate to a CLI helper. There are no requests for unrelated service credentials.
Persistence & Privilege
The skill is not always-enabled (always: false). Agent metadata permits implicit invocation in the included agent YAMLs (allow_implicit_invocation: true), which is standard for many skills; it means the agent could suggest or run this skill in relevant contexts. This is expected but users should be aware that implicit invocation is allowed.
Assessment
This skill is an instruction-only helper for the third‑party `deyo` CLI and appears internally consistent. Before installing or running anything recommended here, verify the npm package author (@casatwy) and review the package (or its repository) if you can. Installing a global npm package runs arbitrary code on your machine — prefer inspecting the package contents or using a sandbox. Be cautious when creating and storing API keys: confirm the upstream service URL (https://deyo.miaobi.fun) is the legitimate provider you intend to use, and consider creating a limited/rotatable key. If you want the agent to run commands for you, require explicit confirmation rather than allowing automatic execution. If you need higher assurance, ask the skill author or inspect the deyo package source before use.Like a lobster shell, security has layers — review code before you run it.
latestvk9736nkbg6f867vjgrax39h40184sra7
License
MIT-0
Free to use, modify, and redistribute. No attribution required.