rpm

This skill is an instruction-only RPM management guide and appears to do what it says, but review these before installing: - The SKILL.md expects many host tools (rpm, rpmbuild, mock, rpmdev-setuptree, spectool, rpmlint, gpg). The metadata does not declare these — confirm the runtime environment has them and consider updating the skill metadata. - The commands operate on system package databases and GPG keyrings (e.g., rpm --addsign, rpm --rebuilddb). Allowing an agent to run them can modify or sign packages and access local private keys. Only enable the skill where you trust the agent and its environment (prefer a container/VM/test host). - The skill requests no external credentials, which is good, but it can read local config files (~/.rpmmacros, /etc/rpmrc) and use $HOME; treat those as sensitive. - If you plan to allow autonomous invocation, require user confirmation for destructive or privilege-escalating actions (install/remove/sign), or restrict the agent so it cannot execute arbitrary shell commands as root. - Ask the publisher to declare required binaries and to provide a trusted homepage/source. The current owner ID is not human-readable; prefer skills from known maintainers. Given the mismatch about required binaries and the potentially powerful local actions described, proceed cautiously — run in an isolated environment or require explicit user approval before executing package management or signing commands.