skill-seekers

Convert documentation, GitHub repos, PDFs, codebases, videos, and more into structured AI skills using the skill-seekers CLI. Use this skill whenever the use...

This skill description and CLI docs are plausible for a tool that converts docs/repos/videos into AI skills, but there are noteworthy red flags and things to verify before trusting it. What to watch for - Declared vs actual requirements: The registry lists no credentials but the docs expect many API keys (Anthropic, Google, GitHub, Chroma/Weaviate, etc.). Treat that as an inconsistency — expect to supply secrets if you use it. - Third‑party install: SKILL.md tells you to `pip install skill-seekers`. Installing an external package runs arbitrary code on your machine and can access network and files. Only install from a verified source (official PyPI project page, vetted repo). If the registry doesn’t point to a homepage or repo, that’s a transparency gap. - Data exposure: The tool scrapes websites, reads local code and documents, can ingest chat exports, and can upload packaged skills to external services. Don’t run it against private data or supply secrets until you’ve audited the package. - Persistence: It supports `--daemon` and `install-agent` modes and writes workflows to ~/.config. These create longer-lived processes or files; be cautious and prefer one-off runs first. Practical steps before using 1. Find the package source: locate the PyPI page or canonical Git repo for `skill-seekers` and review the code, maintainer, and recent releases. If you can’t find a trusted source, do not install. 2. Run in isolation: test inside a disposable VM or container (or sandboxed environment). Avoid running against sensitive directories or providing production credentials. 3. Use least privilege keys: if you must provide API tokens, create tokens with the minimum scope and expiration, and do not reuse high-privilege keys. 4. Dry-run / --dry-run first: use dry-run or `--no-upload` options where available to see what it would do. 5. Inspect generated outputs and network activity: watch for unexpected uploads or connections (use network monitoring) and inspect files written to ~/.config or output directories. 6. Prefer local-only flags: avoid `--no-rate-limit`, `--daemon`, and background uploads until you trust the package. If you want, I can: (a) summarize the specific env vars and commands the SKILL.md references, (b) suggest a minimal safe command to test in a container, or (c) help draft a checklist to audit the package source before installing.