Fizzy

This skill appears to genuinely manage Fizzy boards, but there are mismatches you should resolve before trusting it. SKILL.md asks you to install a third‑party Homebrew tap and to provide a personal API token, account slug, and API URL (or put them in ~/.config/fizzy/config.yaml). However, the registry metadata does not declare those required environment variables or config paths. Before installing or providing credentials: 1) Verify the Homebrew tap owner (robzolkos) and inspect the fizzy-cli source code or formula to ensure it is legitimate. 2) Prefer creating a least‑privilege token (read/write scope minimized) and avoid putting long‑lived secrets in global shell profiles; use a session‑scoped export or a restricted config file. 3) Confirm the API URL is the intended service (self‑hosted endpoint) to avoid accidentally sending data to an attacker-controlled host. 4) If you cannot verify the tap/source, run the CLI in an isolated environment (container, throwaway VM) or decline installation. The metadata inconsistency is the main reason for caution.