i-have-adhd: why it is not safe to use

What we found

Our review of `ayghri/i-have-adhd` did not identify security or privacy findings that prevented approval. Based on the inspected repository files, the skill clearly states what it does and when it should be used, with instructions visible in the README, `AGENTS.md`, and `SKILL.md` rather than hidden in less obvious places. We did not find evidence of undisclosed data sharing, runtime remote fetch or execution, hardcoded secrets, encoded or concealed payloads, or attempts to access credentials, home-directory configuration, unrelated files, or caches. We also found that the skill text tells agents to get confirmation before destructive actions such as `rm -rf`, force pushes, or schema changes.

What to do instead

If you are evaluating whether to use this skill, the practical takeaway is to review the same repo documents to confirm the behavior matches your needs and to keep normal approval controls in place for any destructive action. You should also continue standard due diligence for any third-party skill, including checking for repo changes over time and limiting access to only the data and tools required for the task.