Write My Blog

This package appears to be a legitimate self-hosted blog platform, but exercise caution before running its setup or allowing an agent to run it autonomously. Key points to consider: - The repo and scripts will ask for or expect sensitive credentials (Supabase service role key, MongoDB URIs, Redis URLs) and will write them into platform/.env.local; the skill metadata did not declare these needs. Only provide least-privilege keys, and avoid giving high-privilege service keys unless you understand the implications. - The setup script can run non-interactively and will overwrite an existing .env.local without prompting in that mode. Don’t run non-interactive setup in an environment where the agent has access to unrelated secrets. - The setup runs npm install (downloads many packages). Run it in an isolated environment (container/VM) if you want to limit blast radius. - Review scripts (scripts/setup.sh, deploy-*.sh, and any DB adapter code) yourself before executing. If you plan to deploy, create dedicated deployment/service accounts and rotate keys after use. - If you want the agent to operate this skill, prefer interactive setup and manual provisioning of cloud credentials rather than exposing them to the agent runtime. If you have questions about specific files or want a focused review of the DB adapters or middleware, ask and I can inspect those parts in detail.