pushplus

This skill appears coherent and low-risk: it only needs a PushPlus API token and uses curl to call the official PushPlus endpoints. Before installing or using it, consider: (1) Provide the token via environment variable rather than pasting it into chat to avoid leaking it in conversation history. (2) Confirm the agent follows the SKILL.md safety rules — especially that it asks you for confirmation before sending any message and does not store or print the full token. Because the skill is instruction-only, there is no code enforcing those rules; they depend on the agent implementation. (3) Avoid including sensitive secrets or PII in messages sent through a third-party service; if you must, review PushPlus’s privacy/security policy. (4) If the token is ever exposed, revoke/regenerate it immediately. If you want stronger guarantees, prefer a skill with audited code or one that performs token handling within vetted code rather than free-form agent instructions.