Protagons

Access and deploy AI character identities from the Protagons library, search by keyword or category, list options, and generate new characters with a Google...

This skill appears coherent with its stated purpose: browsing and deploying public character identities and offering a generation endpoint that uses a Google key you provide. Before installing or using protagons_generate, consider: (1) generation requires you to send a Google/Gemini API key to api.usaw.ai — use a scoped, limited, or throwaway key if you are uncomfortable sharing your primary key; (2) the package claims the key is not stored, but that is a privacy policy assertion you must trust the service for; (3) review the service's privacy/security documentation (usaw.ai) if you need stronger guarantees; (4) the code provided appears to only call the stated API and not read local files or env vars, but the protagons.mjs content in the prompt was truncated — if you require higher assurance, request or review the full, untruncated source for protagons.mjs to confirm no additional behavior (e.g., hidden network calls or local data access).

Package: (mcp) Version: 1.1.0 Description: Browse, search, deploy, and generate Protagon AI character identities. Deploy loads a rich SOUL.md personality for the agent to adopt. The package provides tools for interacting with the Protagons API to browse, search, deploy, and generate AI character identities. All network communication is performed over HTTPS to the declared `api.usaw.ai` endpoint. Input parameters for API calls are properly encoded using `URLSearchParams` or `encodeURIComponent`, mitigating URL injection or path traversal risks. The package does not perform any local file system operations or execute system commands. The most significant security consideration is the `protagons_generate` function, which requires and transmits a user-provided `google_api_key` to the `api.usaw.ai` backend. The package documentation (`SKILL.md`, `config.json`) is transparent about this, stating the key is used for a single server-side Gemini call and is not stored. While sending a user's API key to a third-party service always carries an inherent trust risk, the explicit disclosure and recommendation to use scoped or throwaway keys mitigate this concern. The code correctly handles this transmission over HTTPS within a JSON body. No other sensitive data is handled or transmitted in an insecure manner. The package's logic aligns with its stated purpose and transparently communicates its external dependencies and credential handling.