Security audit
Security checks across malware telemetry and agentic risk
This digest skill is legitimate in purpose, but it gives unpinned remote prompts, scheduled background jobs, and local delivery credentials enough control that users should review it before installing.
Install only if you are comfortable with a skill that fetches current prompt instructions from GitHub, stores Telegram or Resend credentials locally when enabled, and may create recurring scheduled jobs. Prefer stdout/on-demand mode if you do not need automatic delivery, inspect any cron entry it creates, and avoid adding third-party keys unless you need off-terminal delivery.
Then add the token to the .env file. To get the chat ID, run: ```bash curl -s "https://api.telegram.org/bot<TOKEN>/getUpdates" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d['result'][0]['message']['chat']['id'])" 2>/dev/null || echo "No messages found — make sure you sent a message to your bot first" ``` Save the chat ID in config.json under `delivery.chatId`.
Use system crontab so it runs even when the terminal is closed: ```bash SKILL_DIR="<absolute path to the skill directory>" (crontab -l 2>/dev/null; echo "<cron expression> cd $SKILL_DIR/scripts && node prepare-digest.js 2>/dev/null | node deliver.js 2>/dev/null") | crontab - ``` Note: this runs the prepare script and pipes its output directly to delivery, bypassing the agent entirely. The digest won't be remixed by an LLM — it will
1. Go to https://resend.com 2. Sign up (free tier gives 100 emails/day — more than enough) 3. Go to API Keys in the dashboard 4. Create a new key and copy it Add the key to the .env file.
66/66 vendors flagged this skill as clean.
Detected: suspicious.env_credential_access, suspicious.install_untrusted_source
