Fridge Cam

Name/description claim a fridge-inventory camera and mocking messages, which fits the high-level purpose, but the skill's runtime steps require controlling workstation brightness/locking and verifying physical exercise via camera. Those capabilities are not declared in metadata (no required binaries, no install instructions, no config or permission requirements), which is disproportionate.

SKILL.md explicitly tells the agent to run external commands (e.g., `camsnap snap fridge --out t1.jpg`) and to invoke a PowerShell helper (`authority-bridge.ps1`) to change brightness/lock the workstation and to perform CV-based verification of exercise. Those instructions access camera and system controls and could capture/transmit images or alter device state — none of which are constrained, justified, or declared.

There is no install spec and no code shipped, yet the instructions expect binaries/scripts (`camsnap`, `authority-bridge.ps1`) to exist. That gap means the skill relies on out-of-band tools (which may be absent or malicious) and provides no secure way to verify or install trustworthy implementations.

The skill requests no environment variables or credentials, but its behavior requires access to sensitive resources (camera feed, ability to change brightness/lock workstation). The lack of declared permissions or required config paths is disproportionate and prevents meaningful pre-install consent or audit.

always is false (so it won't be force-included), but model invocation is allowed (normal). Because the skill can instruct system-level actions (locking/dimming, CV verification), autonomous invocation combined with the other gaps increases risk — consider disabling autonomous invocation until the implementation and permissions are reviewed.