Octolens

The skill's code matches its description — it only queries https://app.octolens.com/api/v1 and prints results — but the package metadata failing to declare the required API credential is a red flag. Before installing: - Verify the Octolens service and domain (app.octolens.com) are legitimate and that you trust the publisher (no homepage or known owner is listed). - Provide an API key only when necessary and consider creating a key with limited scope/permissions and an expiration if the service supports it. - Prefer passing the API key as a command-line argument or ephemeral prompt rather than storing it permanently in agent config; confirm how your agent stores secrets. - Review the included scripts yourself (they are short and readable) to confirm there are no hidden endpoints or telemetry; the provided files only contact the documented API. Because the metadata does not declare the required credential, treat this skill as suspicious until you confirm the publisher and how API keys will be handled/stored.