Skill Box

This skill is internally coherent for its stated purpose (analyzing your digital traces) but touches highly sensitive data: your logged-in browser sessions and exported chats/screenshots. Before installing or running it, consider the following: - Only run the skill when you have signed into the exact accounts you want analyzed; do not run it if other unrelated accounts are logged in the same browser profile. - The SKILL.md promises 'local only' processing, but that is a behavioral rule, not a technical guarantee you can verify from the skill package itself. Treat that as a trust claim. - The skill requests permission to use the browser proxy (browser(profile="user")). That gives the agent access to pages you can see while logged in. If you are uncomfortable exposing entire feeds or chat exports, opt to provide only redacted excerpts or screenshots, or run with an isolated browser/profile. - The allowed-tools list includes Bash (shell). If your runtime lets you control which tools the agent may use, remove or deny Bash unless you explicitly need shell operations — the SKILL.md does not require shell usage for normal operation. - Review and protect the profiles/ output folder: these files will contain structured summaries of private content. Back them up securely or encrypt them if they must be stored long-term, and delete them when no longer needed. - Test the workflow first with non-sensitive data (fake accounts or redacted exports) to confirm behavior and ensure nothing is posted or transmitted outside your environment. If you need higher assurance, ask the skill author for a minimal-run checklist (exact browser endpoints accessed, concrete examples of commands the agent will run, and a signed statement of 'no network uploads' with reproducible local-only behavior), or run the skill in an isolated VM/container and inspect network traffic and file writes.