Ecto

This package appears to be a legitimate Ghost Admin API CLI. Before installing, consider the following: - The tool requires a Ghost Admin API key (GHOST_ADMIN_KEY) and site URL (GHOST_URL) to function, but the skill metadata did not declare these. Expect to provide an admin-level API key. If you don't trust the source, do not provide credentials. - The CLI saves API keys to a local config file (default: ~/.config/ecto/config.json, or XDG_CONFIG_HOME/ecto/config.json). Ensure you are comfortable storing the key on disk and check file permissions; you can set XDG_CONFIG_HOME to control the path. - The repository source is bundled, but there is no automatic install URL in the metadata — verify the binary you run (or build from source yourself) and prefer installing from a trusted release (official GitHub release or vendor). If you plan to allow an agent to invoke the skill autonomously, be aware that the agent could perform any action the Admin API key permits (create/delete/publish posts, webhooks, upload images). - If you want least privilege, create a Ghost integration with only the permissions you need (if Ghost supports scoped keys) or use a dedicated integration account and rotate keys regularly. If you need higher assurance, ask the publisher for a verified homepage or release artifacts, or review/build the source locally and inspect ~/.config/ecto/config.json after first run.