!
Purpose & Capability
The skill's description says it will call Neo4j (table DDL) and Milvus (QA recall). SKILL.md documents required .env keys (NEO4J_*, MILVUS_*, EMBEDDING_*), but the registry metadata claims no required env vars or credentials. This is an internal mismatch: the skill can use external DB credentials though none are declared.
!
Instruction Scope
SKILL.md describes reading an intent_output.json and writing a multicall output; the included node wrapper (index.js) does not read those files but launches the Python code via stdin. More importantly, index.js reads a parent .env file (../.env) and injects its content into process.env, then spawns Python while passing the entire environment. That behavior expands scope beyond the simple recall task because any secrets present in that .env (or the process env) become available to the skill's subprocess.
✓
Install Mechanism
No install spec or external downloads; the skill is instruction/code-only and relies on a local Python runtime. There are no suspicious remote install URLs or archive extraction steps in the provided metadata.
!
Credentials
Although the registry lists no required credentials, SKILL.md documents many expected env keys for Neo4j and Milvus. index.js actively loads ../.env and propagates the full process.env to the Python subprocess. This creates a risk of exposing unrelated secrets present in the environment, and the skill requests environment access that is not declared in the registry metadata.
✓
Persistence & Privilege
The skill is not requested to be always-enabled and does not modify other skills or system-wide configuration. It runs as an on-demand skill with no elevated persistence privileges.
What to consider before installing
This skill appears to implement the advertised recall functionality, but there are some mismatches and environment handling risks you should address before installing:
- The skill's SKILL.md expects Neo4j/Milvus credentials (NEO4J_*, MILVUS_*, EMBEDDING_*, etc.) even though the registry lists no required env vars. Treat any .env values as sensitive — the skill may use them to connect to your services.
- index.js reads a parent ../.env file and injects those variables into process.env, then forwards the entire environment to the Python subprocess. If your repo .env (or any existing env vars) contains unrelated secrets (cloud keys, tokens), those will be accessible to this skill. Consider removing or sanitizing such secrets before running.
- If you plan to enable realtime Neo4j/Milvus integration, provide only least-privileged credentials and test in a sandbox. If you do not want the skill to access external services, run it in an environment without those .env keys or with dummy credentials — the Python class is written to degrade to a default DDL and empty QA list when services are not injected.
- If you need stronger assurance, open the full multi_call.py file (the part that may create service clients from environment) and confirm it does not transmit data to unexpected endpoints. Alternatively, run the skill locally in an isolated container to observe its outgoing connections.
Given the mismatch between declared requirements and the code's env handling, proceed cautiously and avoid exposing production secrets to this skill until you confirm which environment variables it will actually use.
