Tmp.E4hYN1vheH

This skill appears to be what it says — a bot identity standard and local registry — but take these precautions before installing or deploying: 1) Metadata mismatch: SKILL.md requires Node.js and npm; confirm the environment has Node >=18 before proceeding. 2) Review upstream code: the skill instructs cloning and running npm install; inspect the repository (packages/registry, cli, sdk, extension) for any unexpected behavior before running. 3) Protect private keys: never upload your bot private key to untrusted services; follow the project's guidance that private keys remain local. 4) Browser extension caution: extensions that auto-sign or inject headers may need access to keys — review extension code and permissions; avoid loading unsigned/unreviewed extensions into a production browser. 5) Deployment secrets: if you deploy a registry, store RIC_ADMIN_KEY and other secrets in a secure secrets store (Render/Netlify/Environment) and rotate keys if exposed. 6) Sandbox first: run the registry locally in an isolated environment, confirm audit-logging behavior, and validate what data is published to any public audit log. If you want more confidence, provide the upstream repository URL or a copy of the registry/cli source files for a deeper code-level review.