Permission Vending Machine

Multi-channel approval system for AI agent permissions. GATES sensitive operations (file deletion, git force-push) behind human approval. Notifies via iMessa...

This implementation broadly does what it claims, but several red flags mean you should not install it without review and configuration. Key things to check before installing: - Verify and lock down the HTTP approval endpoint: by default the daemon binds 0.0.0.0 and the approval handler will approve the most-recent pending request when no token is provided — ensure the server is bound to localhost or to an internal-only interface or protected by authentication/firewall rules, and confirm the server enforces tokens/signatures for approvals. - Expect to provide several sensitive credentials (IMAP/SMTP password, Sendblue API key, webhook URLs, Telegram bot token). The registry metadata lists none; confirm where you will store these and restrict file permissions. Prefer dedicated service accounts / app-specific passwords and rotate keys. - Confirm presence and provenance of the sendblue CLI if you enable iMessage: the code calls `sendblue` via subprocess; the registry said no required binaries but the channel depends on it. Installing a CLI without verifying it is risky. - Review server.py and CallbackHandler.verify_discord_interaction to ensure signature verification is actually enforced for each channel you enable (the code contains a verifier but you must confirm the server uses it and that secrets are configured). - Audit how approvals are parsed (email/IMAP): email approvals look for plain APPROVE/DENY and an optional token. This works but means anyone who can send mail to the configured mailbox (or compromise it) can grant privileges. Hardening the mailbox and using tokens is strongly recommended. - Test in an isolated environment first (local VM) and run with minimal channels enabled (e.g., only local Discord webhook or localhost HTTP with auth) before exposing to network or adding real approvers. Given these mismatches (missing declared requirements vs. real config needs) and the potentially insecure default approval behavior, treat this skill as suspicious and perform the checks above (or request a signed/verified upstream release and provenance) before trusting it on production hosts.