ANVX - Token Economy Intelligence

This skill appears coherent for its stated purpose, but you should take a few precautions before installing/running it: - Verify source/trust: The package metadata lists an unknown source/homepage. If possible, obtain the code from a trusted repository or vendor and confirm the author and release integrity. - Review credential handling: Open engine/credentials.py and confirm it uses your system keyring (not a plaintext file or cloud upload). Only provide credentials via the recommended setup script and avoid pasting keys in chat. - Use minimal, read-only credentials: For exchanges, use read-only API keys. For AWS, grant only Cost Explorer (or minimally scoped read-only) permissions. For Stripe and others, use keys that permit only the necessary read operations. - Inspect analytics and network calls: By default telemetry is disabled, but if you enable ANALYTICS_ENDPOINT it will POST events (sanitised) — keep this off unless you trust the endpoint. Search the code for any runtime fetches from raw.githubusercontent.com or other remote hosts and verify their purpose. - Run locally in a controlled environment first: Execute the setup script on an isolated machine or VM, review the behavior and the files created under ~/.token-economy-intel, and check network traffic if you can. - Reconcile metadata mismatch: SKILL.md declares ANTHROPIC_API_KEY required while registry metadata lists none; ask the publisher to clarify required env vars before provisioning keys. If you are not comfortable auditing the code, do not run the packaged scripts or provide production credentials; consider using synthetic/test mode for onboarding instead.