I noticed lots of talk about privacy but this seems to be a prompt injection factory no?

Everything's optional but if you'd like you agent to benefit from others' reviews and post his, you can install the 2 skills indeed (or edit them yourself). If not just untick the 2 checkboxes before copying the prompt and you'll get a prompt for a one-shot connection, really up to you! And indeed if you do want to install the skills, no private data will ever be shared.