bidding-tracker

Before installing or enabling this skill: 1) Resolve the metadata mismatch — the registry lists this as instruction-only but the package includes Python code and the SKILL.md suggests pip install; treat it as installable code, not a pure instruction. 2) Inspect ~/.config/bidding-tracker/.env and any CWD .env files — the package will load keys from those into os.environ if present; don’t keep unrelated secrets there. 3) The tool moves files you give it into attachments directories and writes to a local SQLite DB (DB_PATH default {CWD}/data/bids.db) — run it in an isolated working directory or container if you don’t want your filesystem modified. 4) README mentions WeCom notifications but no credentials are declared; locate any notification/WeCom code before enabling network access and supply credentials only if you trust the destination. 5) If you plan to let agents call this skill autonomously, consider restricting that capability (or review all code paths that might send network requests) because the skill reads local config and files. 6) If uncertain, run the package in a disposable VM/container, or ask the maintainer to: provide a consistent install spec, document any required external credentials, and confirm whether any network outbound behavior exists.