Security audit
Security checks across malware telemetry and agentic risk
The skill mostly matches its marketing-nudge purpose, but it under-declares a status-changing RedReplier API action while also relying on a stored API token and scheduled background polling.
Review this before installing if you are comfortable storing a RedReplier token locally and running a background job every 5 minutes. Use a dedicated, revocable token, keep the config file private, and be aware that each poll changes RedReplier server state. Also note that approve/reject triage updates a RedReplier mention-status endpoint that is not included in the declared network permission path.
The token never appears in a command-line argument. `setup` reads it from a hidden prompt or from stdin, and refuses a `--key` flag outright. Keep it out of your crontab too: the cron examples below rely on the stored config file rather than an inline variable, so the secret stays in one `600` file instead of being copied into `crontab -l` output, process listings and backups. To rotate or revoke, delete `~/.config/redreplier/config.json` and generate a new token at
## Run it on a schedule — READ THIS, it's the whole point This skill does **not** poll by itself, and there is **no webhook** — RedReplier's API is pull-based. Installing the skill only gives you a command. **You (the host agent) MUST create a recurring job that runs that command**, or nothing will ever happen. This is a required setup step, not optional.
64/64 vendors flagged this skill as clean.
No suspicious patterns detected.
