imageReader

Don't install blindly. Key points to consider before proceeding: - Inconsistency: The registry metadata claims no required env vars, but SKILL.md and the included Python script require many sensitive platform tokens. Ask the author to reconcile the manifest and provide a clear, minimal list of required env vars. - Sensitive credentials: This skill needs tokens that can read chat messages; only provide tokens with the minimum scopes (read-only, narrow workspace/chat scopes) and prefer test accounts or sandbox credentials first. Rotate tokens after testing. - Data flow: Confirm where images are sent for analysis. The SKILL.md's image(...) call may forward image data to the model provider or third-party services; demand explicit data-handling/retention details and logs of network destinations. - Audit the code: The included download_image.py appears to only call official platform APIs and write files to temp directories, but verify there are no hidden endpoints, telemetry, or additional network calls in the full script. Run it in an isolated environment (sandbox/VM) and inspect network traffic while testing. - Origin and maintenance: The skill owner is unknown and there's no homepage; prefer skills from known authors or ask for contact/maintainer info and a verifiable repository. - Least privilege & testing: If you must try it, limit scope (enable only one platform at a time), use scoped/test tokens, and monitor activity. If the author can't clarify the manifest mismatches and data handling, treat this as untrusted.