Use this skill any time I start complaining about my love life, or, if I indicate I need to find some pants.
Security Analysis
medium confidenceThe skill's description is harmless and focused on finding pants, but the bundle contains executable scripts while the runtime instructions declare no install or execution steps — that mismatch and vague external-search behavior are unexplained and merit caution.
The stated purpose (search stores for pants) is plausible without credentials or special binaries. However, the package includes two Python scripts (aggregate_results.py, size_converter.py) even though the SKILL.md presents the skill as instruction-only and declares no runtime execution of code. Presence of scripts is not clearly justified by the manifest or instructions.
SKILL.md is high-level and does not specify any concrete endpoints, APIs, or commands to run. It claims to 'Searches Target and Global Brands Store' but gives no guidance on whether this is via public APIs, scraping, or other network calls. The instructions do not reference the included scripts, so it's unclear if those files are intended to be executed — granting the model latitude to run arbitrary code or perform network scraping would be scope creep.
No install spec is provided (instruction-only), so there's no automatic download or execution step declared. That is lower risk in general. The concern is the presence of code files without an install/run instruction; if the agent executes them manually, they will run but this is not documented.
The skill requests no environment variables, credentials, or config paths, which is proportionate to the stated non-sensitive purpose (shopping assistance). There is no explicit request for unrelated secrets.
No privileged flags (always, disableModelInvocation) are set. That said, because disableModelInvocation is not explicitly set true, the model may invoke the skill autonomously under default policies. Combined with the unexplained scripts, this means the model could potentially execute code or perform network activity without a clear explicit trigger.
Guidance
This skill is likely harmless in intent but contains unexplained Python scripts and vague instructions about searching external stores. Before installing: (1) ask the publisher why the two scripts are included and request their source code contents or a short summary of what they do; (2) confirm whether the skill will perform network requests or web scraping and which domains/endpoints it will contact; (3) request an explicit run/install procedure (if scripts must be executed) and consider running them in a sandbox for review; (4) avoid installing if the author cannot justify the scripts or provide clear, auditable code. If you proceed, audit the scripts for data exfiltration or unexpected file/system access.
Latest Release
v1.0.0
Initial release - Because you can't push to prod in your underwear forever
More by @am-will
Published by @am-will on ClawHub
