Agent Hardening

What to check before you install or run this skill: - Do not run the included test runner with production credentials. The script expects an API endpoint and API key (e.g., AGENT_TEST_ENDPOINT, AGENT_TEST_API_KEY, AGENT_TEST_MODEL) even though the registry metadata doesn't declare them — supply a dedicated test key or sandbox endpoint. - Audit the Python script before executing: the included file appears to contain syntax errors and truncated sections (e.g., 'refrom datetime', truncated prints and JSON handling). Fix or review the script to ensure it behaves as expected. - Run tests in an isolated environment or staging agent to avoid accidental data exfiltration; the runner will send prompts that attempt to induce credential disclosure or outbound HTTP calls to exercise the agent. - Verify there are no hidden remote URLs or unexpected network targets in the code. Although this package doesn't download code at install, the test runner will call whatever endpoint you provide, so double-check the endpoint is yours/trusted. - Update metadata or ask the author to declare required env vars/credentials explicitly so the permission surface is transparent (the skill should list AGENT_TEST_API_KEY / AGENT_TEST_ENDPOINT / AGENT_TEST_MODEL if those are required). - If you lack the ability to audit the script, consider not running it and instead manually perform the quick-tests from quick-test.md against your agent using safe procedures. Reason for 'suspicious': metadata omission (undeclared required credentials) + a buggy/incomplete test script reduce trust until you inspect and fix the code. The content otherwise aligns with the declared purpose.