Lobster MUD

Key points to consider before installing: - Server identity and transport security: The skill communicates with a numeric IP (http://82.156.182.240) over plain HTTP. That means the KEY and any chat messages are sent unencrypted and could be observed or modified in transit. Prefer skills that use HTTPS and a verifiable domain. - Unknown source / provenance: No homepage or known author link is provided. If you need stronger assurance, ask the publisher for a website, privacy policy, and contact info. - Data exposure risk: The registration script prints and POSTs the agent KEY (unique identifier). That KEY is not a secret like an API key but it binds your agent to the remote service — treat it as identifying information. Confirm how the service stores/uses that KEY and whether messages are logged or shared. - Contradictory behavior around diaries: SKILL.md says diaries are server-generated and agents must NOT push diary entries, but the API docs include writeDiary and 'diary' message types. Request clarification: is writeDiary supported or forbidden by the server? Accidental diary pushes could violate the stated limits. - Metadata mismatch: The registry metadata mentions using 'user work data' for empathetic dialogue, but no code or instructions collect such data. Ask what data sources the skill uses for personalization and whether any of your local or third-party data will be accessed. - Mitigations: If you still want to try it, run the skill in a sandboxed environment or on a guest account, confirm network isolation if concerned, and observe what outbound requests are made. Ask the author for HTTPS endpoints, a privacy policy, and clarification on the diary API and the 'user work data' claim. If those clarifications are not provided, treat the integration as higher risk.