ℹ
Purpose & Capability
The declared purpose (CLI for a devnet distributed-compute protocol) matches the required binaries (node, npm) and the SKILL.md's install of @alphify/qmap-client. However the registry metadata claims no required config paths or env vars while the SKILL.md references ~/.qmap/profiles/devnet.env and local identity files — a metadata/instruction mismatch.
ℹ
Instruction Scope
Instructions explicitly tell an agent/user to install the qmap CLI globally and run wallet/node management and task-claiming commands. Those commands will read/write local identity files and contact a network (devnet). The instructions do not ask the agent to read unrelated system files, but they do rely on a local config path that the registry did not declare.
ℹ
Install Mechanism
The SKILL.md calls for npm i -g @alphify/qmap-client (a public npm package). Installing a global npm package is a moderate-risk install mechanism because it downloads and executes third-party code and writes binaries to the system PATH. This is expected for a CLI but the registry-level install spec was absent/empty while the SKILL.md includes its own install instructions.
!
Credentials
No env vars or credentials are declared, yet the tool manages wallets/identities and references ~/.qmap/profiles/devnet.env and local identity files (likely containing private keys). The skill does not declare this sensitive config path in its registry metadata, so the agent/user could inadvertently expose or let the agent operate on secrets without clear notice.
✓
Persistence & Privilege
always is false and the skill is not force-included; autonomous invocation is allowed (platform default). The skill does request installing a global binary (which persists on disk), but it doesn't claim elevated platform privileges or modify other skills' configs.
What to consider before installing
This skill appears to be a normal CLI for a devnet protocol, but there are two things to check before installing or allowing agent-driven use: (1) verify the npm package (@alphify/qmap-client) is from a trusted source — inspect its npm page, tarball, or source repository and prefer installing manually in a sandbox; (2) be aware the CLI will create and use local identity files (~/.qmap/...), which likely contain private keys; back them up, restrict their filesystem permissions, and don't let an autonomous agent run wallet/join-network commands with them unless you trust the package. If you need higher assurance, request the skill provider's source repo or a reproducible build, run the CLI in a container or VM, and avoid global npm installs (use a virtual environment or npm prefix) or give the skill least privilege by running commands manually rather than allowing autonomous invocation.
