MindLogger

Key things to check before installing: - Metadata mismatch: The skill's instructions require MINDLOG_API_KEY, TELEGRAM_BOT_TOKEN, TELEGRAM_CHAT_ID (and reference MINDLOG_BASE_URL/Grok), but the registry lists no required credentials. Ask the publisher to correct the registry or provide source code so you can verify behavior. - Onboarding behavior: The skill will proactively message the user on registration and repeatedly request secrets until provided. If you prefer explicit opt-in or confirmation before sending messages or storing credentials, do not install until that behavior is changed. - Secrets handling: Confirm where and how API keys/tokens will be stored (encrypted at rest? who can read them?). If you can't verify secure storage, do not give production credentials — consider creating limited-scope test credentials. - Scheduling/elevated perms: The skill will add cron jobs and may ask for elevated permissions or to modify HEARTBEAT.md. Only grant scheduling privileges if you trust the skill; prefer explicit user approval for each scheduled action. - Source and ownership: There is no homepage or source repo. Request the source code or a reputable publisher identity before trusting a skill that asks for persistent credentials and scheduling access. If the publisher provides a source repo and updates the registry to declare the env vars and storage practices, re-evaluate. For now, proceed only if you accept the above risks and can limit credentials (test keys) and control scheduling permissions.