Youtube Instant Article

Key things to consider before installing or running this skill: - Secrets are required but not declared: The scripts expect TELEGRAPH_TOKEN and the summarize workflow expects an OpenAI key (SKILL.md/README), yet the registry metadata lists no required env vars. Confirm the manifest is updated to declare these credentials before trusting the skill. - Unexpected .env sourcing: SKILL.md suggests sourcing /Users/viticci/clawd/.env and the wrapper will source $HOME/clawd/.env if present. That is unusual: the skill may read any secrets in those files. Do not run the scripts if you keep unrelated secrets in such files; instead set only the necessary env variables in a controlled shell or dedicated .env in the project directory. - Inspect network endpoints: The scripts upload images to catbox.moe and publish pages to api.telegra.ph; these are expected but are network calls that send image data and the Telegraph access token. If you have policy concerns about public image hosting or third-party storage, replace or review that behavior. - Run in a sandbox first: Execute the scripts in a controlled environment (throwaway account / container) to confirm behavior. Use a test Telegraph account and a limited OpenAI key or billing guard to avoid unexpected costs or exposure. - Request fixes from the publisher: ask the skill author to (1) declare required env vars in registry metadata (TELEGRAPH_TOKEN, OPENAI_API_KEY), (2) remove hard-coded personal paths (/Users/viticci/...) and the unexpected $HOME/clawd/.env sourcing, and (3) document exactly what is read/sent. If the author cannot justify those oddities, avoid using the skill. Confidence: medium — the code contains clear mismatches and surprising behavior, but there is no direct evidence of intentional exfiltration to unknown endpoints; the issues could be sloppy packaging or an oversight. Additional confirmation (author clarification or updated manifest) would raise confidence.