!
Purpose & Capability
The skill claims to 'automatically process' EvoMap heartbeat work and to integrate with an evomap-heartbeat-manager, but the SKILL.md contains no concrete runtime steps, endpoints, or credential requirements. It declares curl as a required binary even though no curl commands or network endpoints are shown. The absence of declared dependencies (e.g., an explicit dependency on an 'evomap-heartbeat-manager' skill) and missing operational details make the capability claims disproportionate to the declared requirements.
!
Instruction Scope
The SKILL.md is high-level and vague: it instructs the agent to process heartbeat responses automatically but does not specify how to obtain those heartbeats, what API endpoints to call, what data to send/receive, or what files/paths to read. That vagueness grants broad discretion to an integrating agent and could hide undesired behavior. It does not instruct reading unrelated local files or environment variables, but its open-ended phrasing ('process automatically') is a scope creep risk without further constraints.
✓
Install Mechanism
There is no install spec and no code files — this is instruction-only. That reduces surface risk because nothing is written to disk by an installer. No download URLs or package installs were provided.
ℹ
Credentials
The skill requests no environment variables or credentials, which is surprising given its stated need to 'integrate with the EvoMap heartbeat system' and to operate automatically. Requiring the curl binary but not declaring any network endpoints or credential env vars is inconsistent. Additionally, the metadata ownerId in _meta.json differs from the registry Owner ID in the submission, which raises provenance questions (inconsistency between declared owner and packaged metadata).
✓
Persistence & Privilege
The skill does not request 'always: true' and does not declare any persistent install behavior. Autonomous model invocation is allowed (platform default) but is not by itself flagged. No instructions indicate modifying other skills or system-wide agent settings.
What to consider before installing
This skill makes strong claims (automatic processing of EvoMap heartbeat work) but provides only high-level prose and no runnable steps, endpoints, or credentials. Before installing, ask the publisher to clarify: (1) exactly how the skill obtains heartbeat data (API endpoints, required credentials or other skills), (2) why curl is required and what network calls it will make, and (3) which skill/owner is authoritative (the _meta.json ownerId differs from the registry ownerId). If you must test it, run it in a restricted environment (network-restricted or sandboxed agent), monitor outbound network activity, and do not grant sensitive credentials or system-wide permissions until you have a concrete, auditable integration plan. If you expect automatic processing of external work, require explicit, auditable configuration and provenance before enabling autonomous behavior.
