Browse, filter, and discover games in a Steam library. Filter by playtime, reviews, Steam Deck compatibility, genres, and tags. Use when user asks about their Steam games, what to play, game recommendations, or Steam Deck compatible games.
Security Analysis
medium confidenceThe skill's behavior (requires a steam CLI binary, an npm install, and a STEAM_API_KEY) matches its stated purpose, but there are multiple mismatches between the registry metadata and the instructions which could indicate sloppy packaging or missing/misdeclared requirements — investigate before installing or granting secrets.
The SKILL.md describes a Steam library CLI and requires the steam binary plus a Steam Web API key and Steam user ID — these are reasonable for the stated purpose. However the registry metadata provided to the platform lists no required binaries or env vars, creating an inconsistency between what the skill says it needs and what the registry declares.
Runtime instructions are narrowly focused on installing/using the steam-games-cli and calling the steam binary with filters; they request the Steam API key and Steam ID (which are needed to call the Steam Web API). The instructions do not ask the agent to read unrelated files or exfiltrate other secrets.
Although the registry lists no install spec, the SKILL.md instructs users to run 'npm install -g steam-games-cli' — that installs third‑party code to disk and may execute postinstall scripts. This mismatch (no declared install but explicit npm install guidance) increases risk: verify the npm package publisher and review the package contents before installing.
The skill's required secret (STEAM_API_KEY) and a Steam user ID are proportionate to querying a Steam library. The platform metadata omission of these required env vars is concerning because the platform-level permissions/requirements are incomplete or inaccurate — confirm which credentials you must provide and where they will be stored/transmitted.
The skill does not request always:true and does not declare any system-wide config modifications. It is instruction-only and would run only when invoked; no elevated persistence or cross-skill config changes are requested.
Guidance
Before installing or using this skill: 1) Confirm the registry-declared requirements vs the SKILL.md (the SKILL.md says it needs the 'steam' binary and STEAM_API_KEY but the registry lists none). 2) If you plan to run 'npm install -g steam-games-cli', verify the npm package owner, inspect the package contents (or review the GitHub repo at the homepage), and check for postinstall scripts. 3) Only provide your Steam Web API key and Steam ID if you trust the package; treat the API key like a secret. 4) Prefer running the CLI in a sandbox or isolated environment first; if you want tighter assurance, manually review the code on GitHub or use official Steam tooling. 5) Ask the skill maintainer to update registry metadata to declare required binaries/env and to include an explicit install spec so permissions are clear.
Latest Release
v0.4.0
Initial release: Browse Steam library with filters for playtime, reviews, Deck compatibility, tags, and genres
More by @mjrussell
Published by @mjrussell on ClawHub
