Byted Bytehouse Load Analyzer

Before installing or running this skill, consider the following: - Missing manifest declarations: The skill actually needs BYTEHOUSE_HOST, BYTEHOUSE_PORT, BYTEHOUSE_USER, and BYTEHOUSE_PASSWORD but the registry metadata does not declare them; ask the author to add these to requires.env/primaryEnv. - Environment leakage: The script copies and forwards the entire process environment to a spawned subprocess. If your agent environment contains other secrets (cloud keys, tokens, etc.), those may be exposed. Only run this in an environment without sensitive credentials or request the author whitelist only the needed BYTEHOUSE_* variables. - Subprocess and remote code fetch: The script invokes an absolute command (/root/.local/bin/uvx) and passes a git+https VCS spec pointing at GitHub. That will likely fetch and run code at runtime. Verify the referenced GitHub repository and the exact code that will be executed. The SKILL.md mentions 'uv' but the code calls 'uvx' — get clarification and ensure paths/commands are correct and trusted. - Principle of least privilege: If you must use this, run it in an isolated environment (ephemeral container or sandbox) that does not hold other secrets or host-critical access. - Ask the maintainer to: (1) update registry metadata to list required env variables and primary credential; (2) document exactly what subprocess is started and what network fetches occur; (3) avoid passing the full environment to subprocesses or explicitly whitelist environment variables; (4) fix the uv/uvx path mismatch. If you cannot obtain satisfactory answers and confirmation of the upstream code, treat this skill as risky and avoid running it on hosts that contain other credentials or sensitive data.