!
Purpose & Capability
The skill claims to be an 'instruction-only' companion but bundles ~25 Python scripts and data files (model routing, crash reporting, logging, security modules). SKILL.md asks you to set GEMINI_API_KEY / OPENROUTER_API_KEY and LITELLM/OLLAMA endpoints but the registry metadata lists no required environment variables or required binaries — this mismatch suggests the declared metadata is incomplete or incorrect.
!
Instruction Scope
Runtime instructions tell you to pip install requirements, run podman-compose and pull models, then run python scripts/main.py. SKILL.md references local service endpoints and API keys and suggests pulling additional data from GitHub. The SKILL.md also contains unicode-control-character injection signals (pre-scan) which may be trying to influence automated reviewers. Instructions therefore go beyond a simple chat persona: they will start containers, pull models, and run complex code that could read/write local state and call external services.
ℹ
Install Mechanism
There is no marketplace 'install' spec, but SKILL.md instructs installing Python deps and starting Podman containers (podman-compose up -d) and pulling models via ollama. These are reasonable for a self-hosted LLM agent, but the package also includes crash_reporting and comprehensive_logging modules — you should verify where logs/crashes are sent and whether any archives or downloads come from non-official URLs (the data folder asks you to download more files from a GitHub repo, which is traceable).
!
Credentials
SKILL.md requires several environment variables (LITELLM_ENDPOINT, OLLAMA_ENDPOINT, GEMINI_API_KEY, OPENROUTER_API_KEY) but the registry metadata lists none; the codebase includes modules (security.py, crash_reporting.py, comprehensive_logging.py) that could access secrets or transmit telemetry. Requesting model API keys is plausible for the described capabilities, but the metadata omission and presence of telemetry/crash modules mean you should confirm exactly how credentials are used and whether any are sent to third-party endpoints.
ℹ
Persistence & Privilege
The skill is not always-enabled (always: false) and does not declare system-wide modifications, but SKILL.md starts containers and runs a long-lived Python process that opens local endpoints (listed in the doc). Running these services will give the code persistent presence on the host while the containers/processes run — review network bindings and container configs before enabling to limit exposure.
Scan Findings in Context
[unicode-control-chars] unexpected: The SKILL.md contained unicode control characters which are commonly used in prompt-injection attempts to hide or mutate content for automated parsers; this is not expected for a straightforward companion skill and should be inspected (look for invisible characters in the SKILL.md and data files).
What to consider before installing
Key things to check before you install:
- Metadata vs. reality: The registry metadata claims no required env vars or binaries, but SKILL.md requires API keys (GEMINI/OPENROUTER), local endpoints, and container tooling. Ask the author or refuse install until the registry is corrected.
- Audit network/telemetry code: Inspect files like crash_reporting.py, comprehensive_logging.py, security.py, model_router_client.py, and any code that calls requests/httpx or opens sockets. Confirm whether logs or crash reports are sent to third-party endpoints and whether credentials are included in those reports.
- Run in an isolated environment first: If you decide to test, run inside a disposable VM or sandboxed container (not your primary workstation). Avoid running as root. Limit network egress (or use a proxy) until you confirm behavior.
- Inspect Podman/compose configs: Review infrastructure/ podman-compose files to see which ports are exposed, which images are pulled, and any startup scripts that run with elevated privileges.
- Search for hidden characters: Because unicode-control-chars were detected, search SKILL.md and data files for invisible/zero-width characters or suspicious escape sequences that could alter parsing or injection targets.
- Verify external downloads: The data folder tells you to download additional files from a GitHub repo. Confirm the repo/URL and inspect the downloaded content before running it.
- Credentials handling: Confirm where GEMINI/OPENROUTER API keys are used. If the skill forwards them to external services or logs them, do not proceed. Prefer using local model endpoints when possible.
- Content note: The data includes detailed, sexualized image prompts. If that matters to you (safety, policy, or legal reasons), review and decide whether this is acceptable.
If you are not comfortable performing these audits, do not install the skill on a machine with sensitive data or permanent access to your environment.
