DigitalOcean

This skill appears to implement a legitimate DigitalOcean CLI, but metadata and documentation disagree about credentials and packaging — the SKILL.md and script expect an API token at ~/.config/digitalocean/token while the registry metadata lists no required credentials or config paths. Before installing or using it: - Treat the repository as unverified (source/homepage unknown). Prefer official or well-known integrations when possible. - Inspect scripts/digitalocean.py yourself (you already have it) for any unexpected network addresses or file accesses (none were found beyond the token file and the DigitalOcean API in this scan). - Do not store a full-purpose account token unless you trust the skill; create a scoped API token with the minimal privileges needed (e.g., read-only or limited resource scopes), and rotate it after testing. - Consider placing the token in a secure location you control (or pass via a process environment variable) and verify the file permissions (SKILL.md recommends chmod 600). - If you plan to let an agent invoke this skill autonomously, be extra cautious: autonomous access plus an undeclared credential increases blast radius. Require explicit metadata that declares required credentials/config paths and confirm the token scope before enabling the skill. If the owner can update the registry metadata to declare the API token/config path (or provide a safer credential flow), that would resolve the main inconsistency and increase confidence.