ℹ
Purpose & Capability
The skill's declared purpose (push messages via qmsg.zendee.cn) matches the included script which calls that service. However the README/SKILL.md claim '无需 API Key' while both the README and script require a Qmsg KEY — this contradiction is significant.
!
Instruction Scope
SKILL.md and README instruct the agent to read a secrets file (~/.workbuddy/secrets.json) and the script reads a secrets.json file, but the script looks for secrets.json in its own directory (path mismatch). The skill also tells an agent to 'create temporary agent' and read local secret files — reading local secrets is within the feature's scope but the undocumented/ambiguous path and the SKILL.md/registry not declaring the config path is a scope-management problem.
✓
Install Mechanism
Instruction-only skill with a small Python script included and no install spec; nothing is downloaded or written by an installer. Low install risk.
!
Credentials
Registry metadata declares no required env vars/config paths/primary credential, yet the README and code require a Qmsg KEY stored in a secrets.json file. The skill fails to declare its required secret and contradicts its 'no API Key' claim — this is disproportionate and confusing for users.
✓
Persistence & Privilege
always is false and the skill does not request persistent system-wide privileges or modify other skills. Normal agent invocation is allowed (default).
What to consider before installing
Do not install blindly. The skill actually requires a Qmsg KEY (contradicting the 'no API Key' description) and expects a secrets.json but the path is ambiguous: SKILL.md says ~/.workbuddy/secrets.json while the script reads secrets.json from its own directory. Before installing, verify where you'll store the key, confirm the script's path and behavior, and ensure you trust qmsg.zendee.cn because the key and message content will be sent to that external service. If you proceed, either (a) update the script to read the secret from a secure, declared location (or an explicitly declared env var), or (b) place the secrets.json only in a secure folder you control. If anything about the secret handling remains unclear, treat this skill as untrusted.
