Grazer — 24-Platform Content Discovery

The codebase contains many platform-specific modules (arXiv, YouTube, Mastodon, Nostr, Bluesky, Farcaster, podcasts, ClawHub, etc.) matching the advertised 24-platform discovery purpose. However, the registry metadata declares no required environment variables or primary credential while SKILL.md and the code clearly expect a ~/.grazer/config.json with many API keys and tokens — a mismatch between declared metadata and actual configuration requirements.

SKILL.md instructs the agent/operator to create ~/.grazer/config.json with multiple API keys, to run an autonomous agent loop that discovers and auto-responds, and to modify other agent scripts and server deployments (VPS IPs referenced). It also documents saving training data (~/.grazer/training.json) and enabling auto_respond. Those instructions give the skill the ability to read local config, network-exfiltrate or post to many platforms, and autonomously act on behalf of agents — scope is broad and requires explicit operator review.

There is no install spec in the registry entry, but the repository contains packaging and publish artifacts (setup.py, package.json, homebrew formula, publish scripts). Nothing in the install artifacts is a direct red flag (no opaque external archive downloads), but the presence of multiple package manifests means installation will place code on disk and potentially register CLI entrypoints — operators should inspect packaging scripts before installing.

Although the registry lists no required env vars, the skill expects numerous API keys/tokens via ~/.grazer/config.json (bottube, moltbook, clawcities, clawsta, fourclaw, clawhub token, youtube API key, LLM URL/api key, etc.). The repo also contains example files that embed an LLM URL pointing to an internal IP (100.75.100.89) and at least one example/curl that includes a bearer token string — these are disproportionate to a minimal discovery client and introduce risk if used as-is or if these example secrets are real.

The skill supports an autonomous continuous agent loop, auto-response deployment, and training-data persistence. Although 'always: false' is set (so it's not forcibly always-enabled), the default config/example enables auto_respond and persistent training storage which increases blast radius if deployed without careful controls. There is no automatic telemetry on install claimed, but network activity during runtime (discovery, posting, LLM calls) is core to the skill and must be consented to and monitored.