Design With Hopola

Key points to check before installing or enabling this skill: - Metadata mismatch: The package registry shows no required env vars, but SKILL.md and scripts require OPENCLOW_KEY and request network/http and local_file:read permissions. Do not rely solely on the registry summary — inspect SKILL.md and README. - Credential handling: OPENCLOW_KEY is needed to call hopola.ai Gateway; ensure you provide a scoped key and that it is stored securely. The upload flow may call an upload policy endpoint (MAAT_TOKEN_API); set MAAT_TOKEN_API_ALLOWED_HOSTS to only trusted hosts. - Local file access and uploads: The skill will read session/local file paths (e.g., /mnt/data/session_uploads/*) and may upload them. Avoid supplying sensitive files. Review scripts/maat_upload.py to confirm what is sent to the network and that sensitive fields are redacted/logged appropriately. - Endpoint trust: Default upload policy endpoint is https://strategy.stariidata.com/upload/policy — if you override MAAT_TOKEN_API, ensure the host is whitelisted via MAAT_TOKEN_API_ALLOWED_HOSTS. Verify gateway_base_url setting and that you trust hopola.ai for generation calls. - Audit the included scripts: maat_upload.py includes host allowlist checks and redaction logic, which is good, but you should read it and validate behavior in your environment. validate_release.py checks for plaintext keys in the repo; still ensure no keys are committed. - If you have limited security expertise: ask the skill publisher to confirm the omitted registry declarations (required env vars and permissions), or only enable the skill in a test environment where you can control keys and sample inputs. If you want, I can extract the exact lines where credentials/permissions are declared in SKILL.md and list the environment variables referenced in the scripts for a precise checklist to compare against your runtime environment.