Cms Bp Manager

This skill appears to implement the stated read-only BP viewing and AI-audit functionality, but there are a few things to check before installing: - Required credential: The scripts and SKILL.md expect BP_APP_KEY (and optionally BP_EMPLOYEE_ID/EMPLOYEE_ID). The registry metadata shown did not declare these — confirm the platform will provide BP_APP_KEY via cms-auth-skills or that you will set it. Do not provide broader credentials (e.g., AWS keys) — only the BP appKey is needed. - Auto-update behavior: commands.py can contact GitHub and run 'npx clawhub@latest install cms-bp-manager --force' (via shell). This will download and run external code. If you want to limit risk, set BP_MANAGER_SKIP_UPDATE_CHECK=1 and avoid enabling BP_MANAGER_AUTO_UPDATE, or run the skill in an isolated environment and review/approve updates manually. - Network endpoints: the client defaults to a specific BaseUrl (https://sg-al-cwork-web.mediportal.com.cn/open-api). Confirm that endpoint is correct and expected for your environment. - Verify provenance: SKILL.md points to a GitHub repo, but the registry homepage is empty. If possible, inspect the referenced GitHub repo and confirm the owner and release artifacts before trusting auto-update. - Operational advice: run the provided scripts in a sandbox or non-production environment first, inspect network traffic, and ensure the appKey has the minimum necessary scope. If you require higher assurance, request the publisher to add the BP_APP_KEY requirement into the registry metadata and to disable automatic runtime installs or to make updates purely manual. I have medium confidence in this assessment because the code and docs broadly match the stated purpose, but the metadata omissions and runtime install behavior are clear inconsistencies that raise risk. Providing the registry manifest that explicitly lists required envs and disabling auto-update would increase confidence.